Volume III

Introduction

In January 2019, the Commission obtained a copy of a letter from Victoria Police to the Independent Broad-based Anti-corruption Commission (IBAC) regarding its identification of seven human source files that required an assessment to determine whether there had been ‘any possible breaches of legal professional privilege’.¹ Those files related to people in occupations associated with the legal profession. The disclosure prompted an amendment to the Commission’s Letters Patent, to extend the scope of its terms of reference to inquire into Victoria Police’s use of human sources, other than Ms Nicola Gobbo, with legal obligations confidentiality or privilege.²

Term of reference 5 required the Commission to recommend any measures that may be taken to address:

1. the use of other human sources subject to legal obligations of confidentiality or privilege who came to the Commission’s attention during the inquiry
2. any systemic or other failures in Victoria Police’s processes for its disclosures about and recruitment, handling and management of human sources who are subject to legal obligations of confidentiality or privilege, and in the use of such human source information in the broader justice system, including how those failures may be avoided in future.

This chapter examines term of reference 5a and the use of other human sources subject to legal obligations of confidentiality or privilege who were disclosed to the Commission during the course of its inquiry.

The use of a human source who is subject to legal obligations of confidentiality or privilege, such as a lawyer, doctor, journalist or priest, is not necessarily problematic if the information the source provides to law enforcement agencies does not relate to the person to whom they owe such an obligation. For example, a doctor may provide information to a law enforcement agency about a relative or a personal associate that does not relate to the doctor’s occupation or professional duties.

Where, however, a person provides confidential or privileged information to a law enforcement agency in possible breach of legal obligations owed to other people, including their clients or patients, and that information is then used in the investigation and prosecution of a crime, it puts at risk the validity of any criminal convictions that may be obtained from the use of that information.

During the Commission’s inquiry:

• Victoria Police identified the seven human source files mentioned above, plus a further five files relating to people associated with the legal profession, dated between 1990 and 2016. The Commission reviewed these 12 files and, in some cases, examined relevant issues in private hearings.
• Victoria Police identified 91 human source files, dated between 15 March 2016 and 30 September 2019, relating to people associated with other occupations that are potentially subject to legal obligations of confidentiality or privilege, such as nurses and government workers. The Commission audited a sample of 31 of these files.
• Members of the public alleged that 45 people with legal obligations of confidentiality or privilege were used by Victoria Police as human sources. The Commission undertook inquiries to investigate the allegations, including by seeking information from Victoria Police.

Based on the information available to the Commission, there is no evidence to indicate that Victoria Police’s use of any human sources, other than Ms Gobbo, resulted in the use of confidential or privileged information that may have affected the validity of any criminal prosecutions or convictions.

There were, however, some limitations to the Commission’s inquiries. The Commission had to rely on Victoria Police to identify and disclose its relevant human source files, and it did not provide all relevant files to the Commission. During the Commission’s audit, Victoria Police steadfastly refused to make 11 human source files available, on the grounds of public interest immunity (PII). The Commission recommends that those 11 human source files be reviewed by an independent and suitably qualified person appointed by the Victorian Government to ensure that any issues relating to the use of those human sources are identified and addressed as a matter of priority. Security arrangements should be put in place to enable the appointed person to review all relevant information.

Of the human source files that were reviewed, the Commission identified some instances of non-compliance with Victoria Police’s policies and procedures and a potential lack of understanding among police officers about issues and risks arising from the use of human sources subject to legal obligations of confidentiality or privilege. These observations were consistent with observations arising from other aspects of the Commission’s work, including its focus groups with Victoria Police officers who hold human source management responsibilities.

In Chapters 12 and 13, the Commission makes recommendations to improve Victoria Police’s human source management practices and support officers’ compliance with policies and procedures, including by introducing a legislative framework to govern Victoria Police’s use of human sources, improved training for officers who work in human source management, and external oversight of Victoria Police’s registration and management of human sources. The Commission anticipates that the implementation of these reforms will help to address some of the issues and risks identified in this chapter.

The use of other human sources with legal obligations of confidentiality or privilege

Victoria Police’s use and management of human sources is governed by an internal policy, the Victoria Police Manual—Human Sources (Human Source Policy).³ Since 2008, all information relating to the registration and approval of human sources, contact with sources and the dissemination of information provided by them has been recorded in Interpose, Victoria Police’s intelligence and case management system.⁴

The use of human sources who are subject to legal obligations of confidentiality or privilege is not prohibited by Victoria Police policy or procedures; however, since 2014 there have been specific safeguards and requirements in place for their use and management.⁵ Those requirements were introduced following two reviews into Victoria Police’s use of Ms Gobbo as a human source between 2005 and 2009: the Comrie Review and the Kellam Report.⁶

As discussed in Chapter 11, both the Comrie Review in 2012 and the Kellam Report in 2015 identified failures and shortcomings in Victoria Police’s human source policies and practices in relation to its use of Ms Gobbo as a human source when she was registered for a third time in 2005 until 2009. Key recommendations of the Comrie Review and Kellam Report focused on the need for better safeguards around the use of human sources with legal obligations of confidentiality or privilege, including that:

• the ‘utmost caution … be exercised before engaging a human source who may have conflicting professional duties (eg lawyers, doctors, parliamentarians, court officials, journalists and priests etc)’
• legal advice be obtained prior to the registration of a human source who may be subject to legal obligations of confidentiality or privilege.⁷

Victoria Police made changes to its Human Source Policy during 2014–16 and again in 2018, in response to the recommendations of the Comrie Review and Kellam Report. These changes are detailed in Chapter 11.

Victoria Police considers that these changes will prevent the reoccurrence of the types of failures identified by these reviews.⁸ Then Assistant Commissioner Neil Paterson, APM, Intelligence and Covert Support Command, told the Commission:

The failures that have occurred in relation to Ms Gobbo could not occur in the context of our current policies, intrusive supervision and practice and [governance] framework.⁹

That view was shared by Deputy Commissioner Wendy Steendam, APM, Special Operations. In her evidence to the Commission, she explained that the reforms made by Victoria Police, prompted by the Comrie Review and the Kellam Report, mean that the circumstances relating to the use of Ms Gobbo as a human source ‘cannot and will not happen again’.¹⁰

The human source files considered by the Commission and detailed throughout this chapter were dated between 1990 and 2020. As such, some files pre-dated the Comrie Review and Kellam Report and associated changes to Victoria Police’s Human Source Policy, while others were created after Victoria Police implemented many of the recommendations of those inquiries between 2014 and 2018.

The following section details the Commission’s approach to examining these files.

‘Human sources’ and ‘community sources’

Term of reference 5a required the Commission to recommend measures that could be taken to address Victoria Police’s use of any other human sources subject to legal obligations of confidentiality or privilege, who came to the Commission’s attention during its inquiry.

When the Commission’s terms of reference were prepared, Victoria Police’s Human Source Policy distinguished between ‘human sources’ and ‘community sources’, as follows:

• Human source—a ‘person who provides information to Victoria Police (or another law enforcement agency) with an expectation that their identity will be protected’. A human source may ‘actively seek out intelligence or information at the direction, request or tasking of police’; may be in potential danger or harm due to their active relationship with police; and may be the primary source of information in targeted investigations or controlled operations.
• Community source—a person who volunteers information to Victoria Police ‘with an expectation that their anonymity will be preserved’. Also referred to as a ‘community contact’, a community source may provide information to police on a single occasion or on numerous occasions regarding events they see or hear in the context of their everyday habits and routines, and ‘must not be requested or tasked to actively gather intelligence’.¹¹

The Commission interpreted its obligation to consider Victoria Police’s use of human sources with legal obligations of confidentiality or privilege to apply to both source categories, given that both human sources and community sources refer to people who provide information to Victoria Police on a confidential basis.

Additionally, under Victoria Police’s Human Source Policy at the time, both human sources and community sources had to be registered and were subject to certain safeguards, such as the completion of a risk assessment, and supervision and internal oversight by senior officers.¹² The risks relating to the use of sources subject to legal obligations of confidentiality or privilege also apply regardless of whether a person is categorised as a human source or a community source.

In this chapter, the Commission uses the term ‘human source’ to refer collectively to both categories of sources.

During the Commission’s inquiry, in May 2020, Victoria Police removed the category of ‘community source’ from its Human Source Policy.¹³ All sources are now classified as ‘human sources’.

Identifying relevant human source files

The Commission did not have access to the Interpose system and had no means of undertaking its own independent search of Victoria Police’s human source records.

The Commission relied on Victoria Police to:

• identify human source files relating to people with possible legal obligations of confidentiality or privilege who were used, or considered for use, by Victoria Police
• disclose those files and all relevant information to the Commission
• advise if any information was disseminated or Information Reports (IRs) created from information provided by a human source with possible legal obligations of confidentiality or privilege and shared with investigators, and whether that information was used in a criminal prosecution or conviction
• make inquiries, at the Commission’s request, into allegations made by members of the public that certain people with legal obligations of confidentiality or privilege had been used as a human source.

The following sections detail:

• the human source files identified and disclosed by Victoria Police relating to people associated with the legal profession
• the human source files identified and disclosed by Victoria Police relating to people from other professions or occupations that potentially hold legal obligations of confidentiality or privilege and that were dated between 2016 (after the completion of the Kellam Report) and 2019
• the inquiries undertaken by Victoria Police, at the request of the Commission, into allegations from members of the public that a lawyer or other person subject to legal obligations of confidentiality or privilege was used as a human source.

Human sources: the legal profession

The Commission first learned that Victoria Police had identified seven human source files relating to people associated with the legal profession in January 2019, when it was forwarded a copy of a letter from Victoria Police to IBAC by the Department of Justice and Community Safety.¹⁴ The letter, dated 18 December 2018, indicated that Victoria Police had identified:

• six human source files that required an assessment to determine whether there had been any possible breaches of legal professional privilege
• one human source file relating to a lawyer that had previously been disclosed by Victoria Police to IBAC in March 2018.¹⁵

In January 2019, the Commission issued a notice to Victoria Police requiring it to produce all records in relation to the use of any human sources with legal obligations of confidentiality or privilege other than Ms Gobbo.¹⁶

In March 2019 and August 2019, a further five human source files relating to people associated with the legal profession were identified by Victoria Police and disclosed to the Commission and IBAC.¹⁷ In total, 12 human source files relating to people associated with the legal profession were identified by Victoria Police and disclosed to the Commission.

By late August 2019, Victoria Police had provided the Commission with hard copies of reconstructed Interpose human source files for these 12 people, with substantial redactions to de-identify them. Following a series of requests and a discussion of the issue in a public hearing in May 2020, Victoria Police ultimately allowed the Commission to inspect copies of the human source files with fewer redactions at Victoria Police’s offices, so that a more meaningful review could be conducted.¹⁸

The Commission’s review of the 12 human source files

The 12 Victoria Police human source files relating to people associated with the legal profession were dated between 1990 and 2016. Some of those files related to human sources, or prospective sources, whose interactions with Victoria Police occurred before 2014, which is when significant changes were made to Victoria Police human source policies and procedures to implement the recommendations of the Comrie Review and the Kellam Report.

Given the significant changes to Victoria Police’s human source management policies and practices in recent years, the Commission did not seek to undertake a full and comprehensive assessment of the 12 files’ compliance with the Human Source Policy in place at the time. The primary focus of the Commission’s review was to identify whether the use of any of these people as human sources may have resulted in the acquisition and use of confidential or privileged information and, if so, whether this may have affected criminal prosecutions or convictions.

Scope of the review

To examine the 12 human source files, the Commission:

• reviewed the reconstructed human source files from Interpose prepared by Victoria Police
• considered additional information produced by Victoria Police, including copies of legal advice it had obtained
• examined issues in hearings that were closed to the public to protect the identity of the human sources or prospective human sources.

In relation to each human source file, the Commission’s review focused on identifying whether:

• the human source or prospective source, by virtue of their occupation, was subject to a legal obligation of confidentiality or privilege, or had access to confidential or privileged information
• the source had potentially provided confidential or privileged information to Victoria Police
• any information provided by the source had been recorded in an IR and disseminated within Victoria Police
• any information provided by the source had been used in a criminal investigation or prosecution
• Victoria Police officers had turned their minds to any issues relating to the source’s possible legal obligations of confidentiality or privilege
• Victoria Police had obtained legal advice to inform its decision making prior to the registration and use of the source.

Summary of the human source files reviewed

A summary of the 12 human source files is outlined below. These files are numbered in the order provided to the Commission by Victoria Police.

One file dates back to 1990 and the other 11 files range from 2005 to 2016.

Observations from the Commission’s review

Of the 12 human source files reviewed, the Commission observed that:

• Two people were unlikely to have been subject to legal obligations of confidentiality or privilege and, on the evidence available to the Commission, it appears that they did not have access to confidential or privileged information during the time they provided information to Victoria Police.²³
• 10 people were subject to legal obligations of confidentiality or privilege, or had access to confidential or privileged information, during the time they provided information to Victoria Police.

Of those 10 people:

• Eight provided information to Victoria Police that appeared to be of a personal nature or was not otherwise confidential or privileged information, such as legal policy advice.²⁴
• Two may have been in a position to communicate confidential or privileged information to Victoria Police.²⁵

Those two people, both practising lawyers at the time of their contact with Victoria Police, were not registered as human sources. In both cases, the police officers identified, at some point during their engagement with them, that the use of lawyers as human sources could give rise to a potential risk for Victoria Police, and a conflict for the lawyers. These were the only examples among the 12 files reviewed indicating that police officers had identified potential issues with the use of people with legal obligations of confidentiality or privilege as human sources.

Disseminating information provided by people not registered as human sources

The Commission observed that Victoria Police generated and disseminated IRs from information provided by three people who had not been registered as human sources.²⁶ Two of those were subject to legal obligations of confidentiality or privilege:

• a court officer who provided information regarding their personal associations and observations in 2014
• a lawyer who may have provided privileged and confidential information in 2008 and 2014, though Victoria Police advised that no person was charged as a result of the information provided.²⁷

The dissemination of IRs before the registration of a human source is approved, or where there is ultimately no approval, is not permitted under the current Human Source Policy.²⁸

Obtaining legal advice

None of the 12 human source files indicated that Victoria Police had obtained legal advice about the use, or prospective use, of any of those people as human sources. This is despite Victoria Police having received legal advice in October 2011 that raised concerns regarding the use of a lawyer, Ms Gobbo, as a human source. That legal advice led to the commissioning of the Comrie Review.²⁹ Of the 12 human source files reviewed by the Commission, nine related to periods of engagement with Victoria Police after October 2011.

The requirement under the Human Source Policy to obtain legal advice related to the use of human sources with potential legal obligations of confidentiality or privilege was not introduced until September 2014.³⁰ Even then, the requirement was limited to specific circumstances.

The Human Source Policy in 2014 only required the Human Source Management Unit (HSMU) to obtain legal advice from Victoria Police’s Legal Services Department in relation to the quarantine or use of information obtained from a human source that ‘may breach a professional obligation’.³¹

Three of the source files reviewed by the Commission were commenced on Interpose after September 2014, which is when the requirement to obtain legal advice came into effect.³²

The Commission notes, however, that one of those files related to a source (a legal secretary) who provided information obtained from their personal associations and observations; one file related to a person (a self-proclaimed legal adviser) who was unlikely to have been subject to legal obligations of confidentiality or privilege; and one file related to a person (a retired solicitor) who was not used as a human source and no IRs were generated or disseminated from the information they provided.³³

Consequently, while it would have been open for officers to obtain legal advice relating to these three source files, it was not required under the specific policy provisions operating at the time. There was no requirement to obtain legal advice simply because a prospective human source had an occupation that may have been subject to legal obligations of confidentiality or privilege.³⁴ This is now a mandatory requirement under the Human Source Policy.³⁵

Disclosure of a human source in 2020

In May 2020, Victoria Police advised the Commission of a lawyer who was used as a human source in 2019.³⁶ The information was provided to the Commission as a recent example of the operation of Victoria Police’s compliance and audit functions of its human source policies. The source was not included in the 12 human source files reviewed by the Commission.

Victoria Police advised the Commission that in 2019, a lawyer contacted a police officer to provide information in relation to the potential criminal offending of their personal associates.³⁷ In early 2020, the officer submitted several IRs containing information derived from the lawyer, in which the officer claimed that the source of the information was either ‘anonymous’ or that it was provided by an unnamed member of the public. This was contrary to the Human Source Policy, which required a person to be named, or alternatively to be registered as a human source, before an IR is completed.³⁸

Detectives reminded the officer that if information was being provided on a confidential basis, the officer needed to register the lawyer as a human source. When that registration process commenced and the officer entered the person’s occupation into the Interpose system as ‘lawyer’, the HSMU was automatically notified.³⁹

As a result, the matter was brought to the attention of the Victoria Police Human Source Ethics Committee (Ethics Committee), which requested:

• a full chronology of matters and the IRs generated
• legal advice
• that the HSMU complete a complaint/incident form and submit it to Professional Standards Command in respect of the actions of the officer, which could amount to a breach of Victoria Police policy.⁴⁰

The Ethics Committee ‘administratively approved’ the dissemination of the IRs that had already been created and disseminated. As the officer and the handling team no longer sought to register the lawyer, the Ethics Committee did not approve their registration on an ongoing basis.⁴¹

Victoria Police considers that this human source file demonstrates an ‘excellent example of its governance processes operating effectively’.⁴²

Human sources: other occupations

As discussed in Chapter 4, in addition to the legal profession, a range of other professions and occupations are bound by legal or ethical obligations of confidentiality or privilege, including medical practitioners and journalists. It is difficult to identify all of these occupations, due to the wide range of legislation, regulations and professional codes of conduct that set out the relevant obligations of confidentiality. It is important to note, however, that a breach of confidentiality by a person is arguably less likely to affect a criminal prosecution or conviction than a breach of legal professional privilege.

To identify whether human sources in other occupations with legal obligations of confidentiality or privilege had been used by Victoria Police, the Commission asked Victoria Police to provide advice regarding the number of human source files relating to people with those obligations, as discussed below. Victoria Police undertook a process of identifying relevant human source files within its Interpose database.⁴³

Identifying other human source files

Due to the limitations of the Interpose system and because there is no automatic way to search and identify human sources who hold or potentially hold legal obligations of confidentiality or privilege, Victoria Police took a very broad approach to identifying relevant human source files. Broad searches were undertaken of the ‘occupation’ and ‘employer’ fields in Interpose; for example, sources described as ‘writers’ were considered potentially relevant to the ‘journalist’ profession, and sources described as ‘carers’ were considered potentially relevant to the ‘medical’ profession, regardless of whether a clear legal obligation of confidentiality or privilege could be identified.⁴⁴

In March 2019, Victoria Police provided initial advice to the Commission that it had identified 285 human sources who may have been subject to legal obligations of confidentiality or privilege. The 285 sources had been used, or considered for use, by Victoria Police between 21 October 2008 (the earliest file created on Interpose) and 12 February 2019.⁴⁵

Following that advice, the Commission initiated an audit of Victoria Police’s human source files.

The Commission’s audit of human source files

The purpose of the Commission’s audit was to:

• inform the Commission’s assessment as to the adequacy and effectiveness of Victoria Police’s current human source management policies and practices, and its compliance with the recommendations of the Kellam Report, relevant to term of reference 3
• identify any issues arising out of Victoria Police’s use of other human sources with legal obligations of confidentiality and privilege, relevant to term of reference 5a.

Scope of the audit

Term of reference 3 required the Commission to inquire into whether Victoria Police’s practices continue to comply with the recommendations of the Kellam Report. As discussed in Chapter 11, according to Victoria Police, the recommendations of the Kellam Report were incorporated into the Human Source Policy on 15 March 2016.⁴⁶ The audit therefore focused on human sources with potential legal obligations of confidentiality or privilege whose files were dated between 15 March 2016 and 30 September 2019, and assessed whether the files were compliant with the iteration of the Human Source Policy operating at the relevant time.⁴⁷

Following Victoria Police’s initial advice that 285 files dated between October 2008 and February 2019 related to human sources who may have been subject to legal obligations of confidentiality or privilege, the Commission sought revised data from Victoria Police relating to files dated between March 2016 and September 2019. As noted above, Victoria Police’s process to identify these files was to search the ‘occupation’ and ‘employer’ fields in Interpose, using broad search terms. Consequently, in addition to capturing the specific occupations identified in the Kellam Report and Victoria Police’s Human Source Policy—doctors, parliamentarians, court officials, journalists and priests—the search also captured a range of other occupations.⁴⁸ For example, occupations under the ‘medical’ category included general practitioner, nurse, youth worker, social worker and therapist.

Lawyers and occupations associated with the legal profession were excluded from the audit as Victoria Police informed the Commission that it had separately disclosed these files, as discussed above.

Victoria Police provided audit data to the Commission in late 2019. In 2020, it identified additional relevant files after discovering that its human source records were incomplete. Of the active human source registration files in Interpose between 15 March 2016 and 30 September 2019, Victoria Police identified that 43 per cent did not have an entry in either or both of the ‘occupation’ and ‘employer’ fields.⁴⁹ These files were subsequently reviewed by Victoria Police, and the human source files they considered relevant to the audit were brought to the Commission’s attention in early 2020.

Based on the data provided in 2019 and 2020, a total of 91 human source files were identified as being within the scope of the audit. Victoria Police provided the Commission with summary information for all 91 files, from which the Commission identified files to audit.

Victoria Police refused to provide the Commission with access to 11 human source files identified as relevant to the audit, claiming that the files were subject to a PII claim. This is discussed further below.

Of the remaining 80 files, 31 were selected for the audit where the summary information indicated:

• the human source or prospective human source’s occupation was clearly subject to legal or ethical obligations of confidentiality or privilege;
• the information provided by the human source to police appeared to be connected with or obtained as a result of their occupation, or it was not clear from the summary whether this was the case; and/or
• there was insufficient detail in the summary information to describe the circumstances in which an individual had been used as a human source or considered for use as a source, or the nature of the information they had provided to police.⁵⁰

Access to hard copy redacted versions of Interpose records for the 31 files was provided to Commission staff undertaking the audit. The 31 files included eight human sources, 22 community sources and one confidential contact. The files related to three professional categories: government, journalist and medical. These files are set out in Figure 10.1.

Figure 10.1: The 31 files audited by occupation

Audit methodology

The Commission’s audit involved reviewing the 31 reconstructed human source files from Interpose and assessing the contents of the files against requirements in place under Victoria Police’s Human Source Policy operating at the time.

The audit focused particularly on compliance with policy requirements arising from the recommendations of the Kellam Report, along with other key policy safeguards designed to manage the risks of using human sources, including those with legal obligations of confidentiality or privilege. These included requirements for officers to:

• obtain approval for the registration of a human source before creating and disseminating IRs containing information provided by the individual⁵¹
• be ‘mindful’ that some human sources, as a result of their occupation, may be bound by duties of confidentiality, privilege or ethical or professional obligations; and to consider the legal and ethical implications when registering a human source⁵²
• seek advice from the HSMU as to the method of handling and recording information from such human sources, and for the HSMU to obtain legal advice from Victoria Police’s Legal Services Department⁵³
• refer a matter to the Ethics Committee where information provided by a human source may be in breach of a legal obligation of confidentiality or privilege, to make a recommendation as to how the information and the source will be treated.⁵⁴

Observations from the Commission’s audit

Of the 31 human source files subject to the audit, the Commission observed that:

• In 18 files, people had provided information to Victoria Police that had been obtained in their personal capacity; for example, information related to their personal associates—including family members and/or neighbours— or from their own personal observations.
• In 13 files, people had provided information to Victoria Police that had been obtained in the course of their employment. Based on the information provided, it does not appear advice was sought from Victoria Police’s Legal Services Department in relation to any of these files, nor were these people subject to consideration by the Ethics Committee.

The Commission’s review of these 13 human source files identified that in only seven of the 13 files did officers identify issues relating to confidentiality or privilege. The files where these issues were identified and the files where those issues were not identified, are discussed in turn below.

Human source files where possible legal obligations of confidentiality or privilege were identified

The Commission observed that seven of the 13 human source files indicated that Victoria Police officers had identified issues relating to potential legal obligations of confidentiality or privilege.⁵⁵ These issues were identified by officers at various stages of the registration and approval process.

The seven human source files where potential legal obligations of confidentiality or privilege were identified by officers included people with occupations as a school counsellor, a prison employee and government workers.⁵⁶

Examples of these files are outlined below.

Human source files where possible legal obligations of confidentiality or privilege were not identified

The Commission observed that for six of the 13 human source files where an individual was providing information to police obtained in the course of their employment, officers had not considered or identified any possible issues relating to legal obligations of confidentiality or privilege.

Upon review of the files, the Commission considered that five of the six files related to information provided by sources that did not appear to be subject to legal obligations of confidentiality or privilege. Rather, the information was gained from personal observations in the workplace or access to official records that, based on the nature of the information, would not have breached an obligation of confidentiality or privilege.

The remaining file related to a nurse who provided information about a patient. An obligation of confidentiality may have existed but was not identified by officers at any stage of the registration process. A summary of this file is outlined below.

In a submission to the Commission, Victoria Police considered that the results of the audit:

… demonstrate that members have generally been able to identify the existence of potential issues relating to legal obligations of privilege or confidentiality and that, with the possible exception of one source, there was no need for the position of the proposed sources to be considered by the [Ethics Committee]. This reflects the reality that most information provided by human sources is not subject to any legal obligation of [confidentiality] or privilege.⁵⁷

Dissemination of information

From the information available to the Commission, it was not always possible to determine if IRs were completed or if information provided by the human sources was shared with investigators. The Commission observed that:

• for some files, IRs were not created or disseminated, as the registration of the human source was not approved or did not eventuate
• notations on other files demonstrated that information obtained from the human source was utilised by investigators or assisted in obtaining search warrants; however, it was not always clear how that information was shared; that is, through IRs or directly with investigators.

The Commission did observe some good, clear examples where IRs were appropriately de-identified to protect the confidentiality of the source’s identity, and where Victoria Police officers took care not to disseminate IRs prior to the approval and registration of a human source.

Human source files subject to a claim of public interest immunity

For 11 of the 91 human source files identified as being within the scope of the Commission’s audit, Victoria Police provided the Commission with a confidential affidavit in support of a claim of PII.⁵⁸ It said these files were extremely sensitive.

Victoria Police did not provide these 11 files for viewing by the Commissioner or Commission staff conducting the audit; instead it provided brief summary information on each of the files and verbally briefed the Commission’s Chief Executive Officer, answered specific questions in relation to the files, and produced advice from senior counsel.⁵⁹ The PII claim over the files was reviewed by ‘independent senior counsel’ for Victoria Police.⁶⁰

The Commission understands that each file was subject to an internal review within Victoria Police, but that none of the files has been subject to an independent or external audit.⁶¹

Further inquiries made in relation to the prospective use of a human source

In 2020, the Commission’s review of documents produced by Victoria Police identified that a religious leader, who was potentially subject to legal obligations of confidentiality or privilege, may have provided information regarding possible criminal activity to Victoria Police as a human source in 2014.

In July 2020, the Commission issued a notice to produce to Victoria Police seeking the production of all documents, correspondence and legal advice relating to the use of, or any decision to use, that person as a human source.⁶²

In response, Victoria Police produced a redacted copy of legal advice received in relation to the prospective use of the person as a human source, and following an additional request by the Commission, provided a copy of an IR detailing the information the person had provided to police regarding possible criminal activity.⁶³

Victoria Police advised the Commission that this person was not registered as a human source and provided information on one occasion. That information was contained in the one IR produced to the Commission.⁶⁴ The Commission understands that no person was charged based on the information provided by the person in 2014.⁶⁵

Human sources identified by members of the public and Ms Gobbo

In February 2019, the Commission invited members of the public and organisations to make written submissions relevant to the Commission’s terms of reference.

The Commission received 27 submissions relevant to term of reference 5a. Those submissions detailed allegations from people alleging that their lawyer, or another person with legal obligations of confidentiality, was a human source. Most of those submitters alleged that their lawyer (or multiple lawyers) was a human source, and that their use as a human source by Victoria Police had affected the criminal investigation and/or prosecution of the submitter’s case.

Some submitters also alleged that their case had been affected by the use of Ms Gobbo as a human source (in addition to alleging that their case was affected by another individual). Those submissions were also considered as part of the Commission’s work on term of reference 1 and its identification of cases potentially affected by the conduct of Ms Gobbo as a human source.

Ms Gobbo herself also alleged that other lawyers may have been used as human sources.

Alleged human sources identified in public submissions

In the submissions received:

• 43 people—comprising 41 lawyers, one court officer and one public servant—were alleged to have been human sources
• four of those lawyers were alleged to have been a human source by more than one submitter.

The detail provided by submitters to support their allegations varied. Some submitters provided reasons for their belief that a person was a human source, while other submitters suggested that their lawyer (for example) was a human source based on the inadequacy of legal assistance they believed they received or the interactions their lawyer had with prosecuting authorities during their trial.

Regardless of the detail provided in submissions, if the Commission was able to reasonably infer that a submitter believed a person with legal obligations of confidentiality or privilege is or was a human source, the Commission made inquiries into the allegations made.

Unlike the Commission’s inquiries under term of reference 1, term of reference 5a did not require the Commission to inquire into and report on the extent to which cases may have been affected by the use of other human sources with legal obligations of confidentiality or privilege. The Commission’s task under term of reference 5a required it to recommend measures to be taken to address any issues arising from Victoria Police’s use of any such human sources, if required.

The inquiries the Commission made on behalf of submitters are discussed below.

Alleged human sources identified by Ms Gobbo

On 10 December 2019, prior to Ms Gobbo giving evidence at the Commission’s public hearings, the Australian Broadcasting Corporation (ABC) broadcast a televised interview with her on its 7.30 program.

During that interview, Ms Gobbo was asked whether she knew of other lawyers who had acted as human sources. She advised the ABC that she was aware of other lawyers, and at least one who was still practising.⁶⁶ Subsequently, Ms Gobbo provided the Commission with the names of two lawyers who she believed may have been used by Victoria Police as human sources.

The inquiries made by the Commission in relation to those two lawyers are discussed below.

Inquiries made into allegations made by members of the public and Ms Gobbo

The Commission took steps to investigate the allegations made by members of the public and Ms Gobbo by seeking information from Victoria Police.

In December 2019, the Commission issued a notice to Victoria Police with a list of the names of 41 people identified by members of the public, including the two people identified by Ms Gobbo, requesting that Victoria Police produce all documents relating to the use or registration of any of those people as human sources.⁶⁷ The names of a further four people identified by members of the public were provided by the Commission to Victoria Police in May 2020, bringing the total number to 45.⁶⁸

The Commission also asked Victoria Police to confirm whether any of the 45 people provided information to Victoria Police in possible breach of their legal obligations of confidentiality or privilege.⁶⁹ Subsequently, with the permission of submitters, brief details of some of the allegations made were provided to Victoria Police to further aid a search of their information systems.⁷⁰

No evidence was produced to the Commission to indicate that any of the 45 people were used, considered for use or registered as human sources.⁷¹

The Commission was unable to ascertain whether any of the 45 people had ever provided information to Victoria Police in possible breach of their legal obligations of confidentiality or privilege. Information received from a human source is recorded in Victoria Police’s Interpose system and there is no dedicated field in the system for officers to input information they consider may be subject to legal obligations of confidentiality or privilege, and no simple automated search function to retrieve such information.⁷²

Conclusions and recommendations

Term of reference 5a required the Commission to inquire into Victoria Police’s use of human sources, other than Ms Gobbo, subject to legal obligations of confidentiality or privilege. In undertaking its task, the Commission sought to determine whether any such human sources had been used by Victoria Police, and if so, the manner in which they had been used. The Commission undertook a review of relevant human source files and, where necessary, examined any issues in private hearings.

While Victoria Police has used, or considered using, other human sources with legal obligations of confidentiality or privilege, there is no evidence before the Commission to indicate that Victoria Police’s use of any of these sources resulted in the dissemination of information that may have affected the validity of any criminal prosecutions or convictions.

The Commission did identify some evidence of officers not complying with Victoria Police’s Human Source Policy or where the Human Source Policy at the time was insufficient to prevent certain actions or manage certain risks. For example, the Commission observed some instances where IRs were disseminated before the registration of a human source was approved, or where there was ultimately no approval. This is not permitted under current Human Source Policy. Victoria Police advised the Commission that this should not have occurred, but that there were no adverse outcomes resulting from the dissemination of information.⁷³

There was also evidence that officers might not have fully understood and addressed issues relating to obtaining and using confidential or privileged information from human sources.

In undertaking its inquiry into term of reference 5a, the Commission was heavily reliant on Victoria Police to identify and disclose relevant files. As detailed further below, the Commission also encountered numerous obstacles in obtaining access to necessary and relevant information. Consequently, the Commission’s conclusions about Victoria Police’s use of other sources with legal obligations of confidentiality or privilege need to be considered with these constraints in mind.

The challenges faced by the Commission mean that further work is needed to examine the use of certain human sources whose files were not provided by Victoria Police. Those challenges also demonstrate that, should any agency or inquiry be assigned responsibility for examining Victoria Police’s use of human sources in future, that agency or inquiry must have full and unobstructed access to the information necessary for it to undertake this task effectively.

The Commission’s conclusions and recommendations are set out in more detail below.

Issues affecting other criminal prosecutions or convictions

The Commission reviewed 12 human source files associated with the legal profession and completed an audit of 31 human source files relevant to other occupations with possible legal obligations of confidentiality or privilege. Based on the limited information made available by Victoria Police, the Commission did not identify any evidence to suggest that Victoria Police’s use of these people as human sources resulted in the dissemination and use of confidential or privileged information that may have affected the validity of any criminal prosecutions or convictions.

The Commission also received no evidence to substantiate allegations from members of the public and Ms Gobbo that 45 people subject to legal obligations of confidentiality or privilege were used as human sources.

Policy and procedural issues

The Commission’s review of the 12 human source files associated with the legal profession identified some shortcomings and inconsistencies in Victoria Police policy and practices at the time relating to the use of human sources. Key examples included officers:

• engaging people subject to possible legal obligations of confidentiality or privilege as human sources without proper identification or consideration of the risks and issues that the use of such sources could pose
• registering such people as human sources without seeking legal advice (though there was not a formal requirement to do so under Human Source Policy at the time)
• disseminating information received from people who were neither approved nor registered as human sources.

Only two of the 12 human source files demonstrated any evidence that officers had turned their minds to potential issues of confidentiality and privilege as part of the risk assessment and registration process.⁷⁴

The Commission’s audit of 31 human source files relevant to other occupations with possible legal obligations of confidentiality or privilege identified some evidence of officers turning their minds to issues relating to confidentiality or privilege, but this was not consistent across the files. Additionally, none of the files were referred for legal advice or consideration by the Ethics Committee. This may be due to a lack of clarity in the Human Source Policy at the time about the types of matters requiring legal advice and Ethics Committee consideration.⁷⁵

The Commission’s audit also suggested that there is a lack of understanding among officers about issues relating to obtaining and using confidential or privileged information from human sources. This corroborated themes and observations that emerged from other aspects of the Commission’s work, including its focus groups with Victoria Police officers; evidence provided by witnesses at the Commission’s hearings; and information produced to the Commission.⁷⁶

As outlined in Chapter 12, Victoria Police most recently amended its Human Source Policy in May 2020.⁷⁷ Some of the changes introduced provide greater clarity about the requirements for legal advice, Ethics Committee consideration and the types of matters that must be referred to the Committee.

Changes to policy alone, however, do not ensure a greater understanding among officers about why the use of a human source with legal obligations of confidentiality or privilege may be problematic; nor a greater understanding of the effect that the use of information improperly obtained from these sources may have on individual criminal prosecutions and the effective operation of the justice system.

As discussed in Chapter 12, the Commission considers that changes to Victoria Police’s policy framework must be accompanied by the training of all officers who work in human source management to:

• support their ability to identify potential legal obligations of confidentiality or privilege
• promote an understanding of the consequences of using improperly obtained confidential or privileged information.

The Commission also considers that changes to Victoria Police’s policy framework and training must be supported by a governance and decision-making structure that provides robust internal oversight and clear accountabilities for decisions about the registration and use of human sources.

As discussed in Chapter 13, the Commission also considers that independent external oversight of Victoria Police’s use of human sources is necessary to:

• enable regular inspection and monitoring of its use of human sources to encourage compliance with the Human Source Policy and detect any issues at an early stage
• promote community confidence in Victoria Police’s use of human sources
• ensure that this high-risk area of policing is subject to independent scrutiny
• promote a culture of greater transparency and accountability to Government, the criminal justice system and the community, and continuous improvement within Victoria Police.

Access to human source files subject to a claim of public interest immunity

During the Commission’s audit of human source files, 11 files were not provided to the Commission for review due to a claim of PII. Victoria Police told the Commission these files were extremely sensitive.

Under the Inquiries Act 2014 (Vic), a person to whom a royal commission has issued a notice to produce documents has a reasonable excuse not to comply with that notice if the information requested is the subject of PII.⁷⁸ The challenges arising from Victoria Police’s many PII claims over material relevant to the Commission’s inquiry are discussed in Chapter 16.

In a submission to the Commission, Victoria Police considered that it would be unreasonable for the Commission to criticise it for ‘upholding its legal responsibilities to the community by maintaining’ its PII claim over these 11 files. It noted that it was open to the Commission to dispute the PII claim by referring the matter to the Supreme Court of Victoria for determination.⁷⁹

The Commission notes Victoria Police’s submission, and further that it is not in a position to assess or question the legitimacy of its PII claim. The Commission did not challenge Victoria Police’s PII claim in the Supreme Court because, given time and budget constraints, it was impractical to do so.

The Commission maintains that it was disappointing that Victoria Police did not provide these human source files to the Commission to review, given the relevance of the files to the inquiry and the fact that the Commission had been specifically tasked to consider the use of such human sources under its terms of reference. This task could have been restricted to a few trusted people who fully understood their obligations of confidentiality, including the Commissioner. Other human source files and documents were provided to the Commission with redactions to information subject to PII claims. With these 11 human source files, however, Victoria Police did not provide the files or any relevant documents in those files, even in redacted form.

While Victoria Police provided the Commission with a brief summary and advice in relation to the 11 files, without full access or, at a minimum, redacted copies of the files, the Commission was unable to confirm whether the use of these human sources was appropriate, or whether it involved any acquisition or use of confidential or privileged information. The Commission understands that these 11 files have not been independently reviewed or audited by any other body for the purpose of identifying whether any of the human sources provided information to Victoria Police in possible breach of their legal obligations of confidentiality or privilege.

In Chapter 13, the Commission recommends that IBAC should be provided with new powers and functions to oversee Victoria Police’s use and management of human sources. Though it is intended that IBAC will have the power to review Victoria Police’s human source files, it will take time, potentially up to two years, to develop and implement the legislation necessary for IBAC to assume its proposed role.

The Commission considers that the 11 human source files subject to a claim of PII need to be reviewed as a priority. For this reason, the Commission recommends that the Victorian Government appoints, within three months, an independent person with suitable legal qualifications and experience to review the 11 human source files.

The review should identify whether the Chief Commissioner of Victoria Police should make a referral to the Victorian Director of Public Prosecutions (DPP) and/or the Commonwealth Director of Public Prosecutions (CDPP), if there is evidence to suggest that any criminal prosecutions were affected either because evidence was improperly obtained by Victoria Police from any of the 11 human sources, or because relevant evidence that should have been disclosed to prosecuting authorities and accused persons was not disclosed.

Any necessary security clearances and protocols should be arranged to ensure that the person appointed to undertake the review has full and unfettered access to the human source files and all relevant information.

The Commission expects that if the independent review recommends that a referral be made to the DPP and/or CDPP, a copy of the independent report and all relevant information should be provided to the appropriate prosecuting agency to enable them to consider whether Victoria Police’s use of any of the human sources potentially resulted in miscarriages of justice.

Victoria Police’s identification and disclosure of other human source files

The Commission necessarily relied entirely on Victoria Police to identify relevant human source files and disclose those files to the Commission. These disclosures occurred at different—and sometimes late—stages of the Commission’s inquiry. For example, Victoria Police:

• disclosed human source files associated with the legal profession to IBAC in December 2018, then disclosed additional files to the Commission in March and August 2019

• identified files relevant to the Commission’s audit in 2019, before identifying additional relevant files in early 2020, after discovering that a large proportion of human source records on Interpose were incomplete.

On 26 November 2020, when this final report was going to print, Victoria Police disclosed to the Commission that it had identified further information relating to one of the 12 human source files associated with the legal profession. The Commission was unable to consider this new information.

System limitations within Victoria Police, and the Commission’s inability to undertake its own independent search of the Interpose system, mean that the Commission is unable to provide assurance that every human source subject to a potential legal obligation of confidentiality or privilege was identified by Victoria Police and disclosed to the Commission. For example, the limitations of the Interpose system reportedly prevented Victoria Police from identifying sources relevant to the Commission’s audit who were not themselves subject to legal obligations of confidentiality or privilege, but who provided information that may have been subject to such obligations.

The difficulty Victoria Police claimed to have in identifying relevant human source files and information points to issues within its record management, audit and system capability. These shortcomings were also evident in Victoria Police’s disclosure of information to the Commission relating to the use of Ms Gobbo as a human source.

As discussed in Chapter 11, in October 2019, a number of enhancements were made to the Interpose system to assist officers in identifying and managing sources with possible legal obligations of confidentiality or privilege, and to better assist in managing compliance with policy timeframes. Those enhancements include prompts for officers when registering human sources to require them to consider whether information provided by a source may be subject to legal obligations of confidentiality or privilege.

The Commission considers that further enhancements to the Interpose system are required to support the identification of potentially privileged or confidential information. In Chapter 12, the Commission recommends that Victoria Police makes further changes to Interpose to enable the timely and accurate recording of the acquisition or use of any such information.

Access to human source files

The Commission encountered a range of other challenges in obtaining access to files and information relating to Victoria Police’s use of other human sources with legal obligations of confidentiality or privilege.

Despite the Commission having issued a notice to produce to Victoria Police in January 2019 requiring the production of all documents relating to the human source files associated with the legal profession, hard copy reconstructed human source files were not provided to the Commission until late August 2019.⁸⁰ Those files were heavily redacted by Victoria Police due to its claims of PII. As the Commissioner was not given access to the unredacted files, she was unable to determine the merits of those claims. Without full access to the files, the Commission could not satisfy itself that Victoria Police, in its use of such human sources, had appropriately considered issues around the use of confidential or privileged information.

Following negotiations with Victoria Police and discussion of the issue in a public hearing, the Commission was provided with access to view the human source files at Victoria Police offices, with some redactions removed in accordance with the Commission’s request. That access was not provided until May 2020, some 16 months after the notice to produce was issued.⁸¹

Additionally, the Commission’s audit of the 31 human source files relevant to other occupations with possible legal obligations of confidentiality or privilege required substantial discussion and negotiation with Victoria Police before Commission staff were provided with access to hard copies of redacted files. As noted above, the Commission was also unable to obtain access to the 11 files, due to Victoria Police’s claim of PII.

The challenges in gaining access to human source files were heightened by Victoria Police responding to the Commission’s requests for information in the form of confidential affidavits, with restrictions on which Commission staff were able to view the information.

In a submission to the Commission, Victoria Police said it granted the Commission appropriate access to relevant human source files as soon as practicable, given the security and PII issues; that Interpose records were difficult to convert into hard copy files; and that redactions were required to protect the identity of the human sources. Victoria Police submitted that it was necessary to approach the provision of information with ‘extreme care’ and that the risk of not doing so could result in someone being seriously harmed or killed. It noted that Victoria Police has legal and moral obligations to take reasonable steps to ensure that this does not happen.⁸²

The Commission appreciates the critical need to protect the confidentiality of a human source’s identity to prevent harm coming to them or those close to them. The challenges the Commission faced regarding timely and full access to human source files, however, underscore the need to provide assurance to the Victorian community that Victoria Police is using human sources appropriately and in accordance with relevant policies and procedures. It also raises the question, as discussed in Chapter 16, of whether the Inquiries Act should be amended to remove the application of PII to royal commissions.

In Chapter 13 of this final report, the Commission recommends that Victoria Police’s use and management of human sources be subject to external oversight. It will be important that the agencies responsible for these oversight functions are provided with full and unfettered access to Victoria Police’s human source files, with appropriate security protocols to facilitate access and protect highly sensitive information.

Endnotes

Introduction

Term of reference 3 required the Commission to inquire into and report on the adequacy and effectiveness of Victoria Police’s processes for the recruitment, handling and management of human sources who are subject to legal obligations of confidentiality or privilege, including:

• whether Victoria Police’s practices continue to comply with the recommendations of the 2015 report commissioned by the Independent Broad-based Anti-corruption Commission (IBAC) entitled Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Kellam Report)¹
• whether current Victoria Police practices in relation to such human sources are otherwise appropriate.

The adequacy and effectiveness of Victoria Police’s current processes for the use of human sources subject to legal obligations of confidentiality or privilege is discussed in Chapter 12. This chapter outlines historical changes made to Victoria Police’s human source policies and examines its implementation of the Kellam Report recommendations.

As discussed in Chapter 1, the Kellam inquiry was the second confidential external review into the use of Ms Nicola Gobbo as a human source between 2005 and 2009. Led by the Honourable Murray Kellam, AO, QC on behalf of IBAC, the Kellam inquiry examined Victoria Police policies and practices relating to the management and use of Ms Gobbo as a human source.² The inquiry followed a series of previous reviews and investigations, from 2001 onwards, into Victoria Police’s human source management practices.

The Kellam Report, finalised in February 2015, made 16 recommendations focused on improving Victoria Police’s processes for the use of human sources, including the use of human sources where legal obligations of confidentiality or privilege may arise.

In examining Victoria Police’s implementation of the Kellam Report recommendations, the Commission considered:

• the effectiveness and timeliness of implementation
• the extent to which Victoria Police’s actions fulfilled the intention of the Kellam Report recommendations, and addressed the issues and shortcomings raised in the report
• the extent to which key recommendations were adequately embedded in practice through policy and procedural amendments and training.

Having reviewed the evidence, the Commission considers that Victoria Police implemented most of the Kellam Report recommendations through a series of amendments to its human source policies in 2015, 2016, 2018 and 2020, with some changes introduced in 2014 while the Kellam inquiry was underway. The changes included new requirements for officers to consult with the Victoria Police Legal Services Department prior to registering a human source with legal obligations of confidentiality or privilege, and to subject these registrations to a more rigorous approval process.

While Victoria Police has taken steps to strengthen its policy framework, many of these reforms were implemented in the past two years and remain untested. In particular, policy changes to apply greater safeguards to obtaining and using confidential or privileged information from human sources—directed at one of the most critical recommendations of the Kellam Report and previous reviews—were only introduced in May 2020, following advice from counsel representing Victoria Police during the Commission’s inquiry.³ As detailed in Chapter 12, the Commission has also identified that current human source management processes need further improvement.

The Commission also considers that some policy and procedural changes arising from the Kellam Report recommendations were introduced by Victoria Police in a manner that contributed to operational complexity and uncertainty, and could have been supported by additional guidance and training for police officers.

As noted above, the Kellam Report followed a series of internal and external reviews into Victoria Police’s management of human sources. Many of these reviews made similar findings and recommendations about the need for more effective supervision, additional training and clearer policy requirements—some of which are also made by the Commission in this final report. The persistence of these issues over time suggests that, while Victoria Police has made substantial amendments to its policy over many years, this has not always resulted in improvements in operational practice.

The Commission considers that there are opportunities for Victoria Police to adopt a more robust and considered approach to policy development, implementation and change management, to ensure that future reforms to its human source management framework are considered carefully, communicated clearly and implemented effectively. This includes establishing clear processes for seeking and incorporating operational input, communicating changes across the organisation, and regularly reviewing and evaluating policy changes.

Development of Victoria Police’s human source policy

Victoria Police’s use of human sources is governed by an internal policy—the Victoria Police Manual—Human Sources (Human Source Policy), which outlines requirements for the registration and management of human sources and the information that they provide.⁴

In Victoria, as in other Australian and international jurisdictions, policies for the use and management of human sources by police have evolved significantly in recent decades. Evidence before the Commission indicated that, while today law enforcement agencies consider human sources to be organisational resources, prior to the 2000s, human sources tended to be managed and ‘owned’ by individual police officers, with little or no policy in place to govern their use.⁵ Over time, reviews into the use of human sources and broader developments in policing increased awareness about the importance of protecting human sources, managing them ethically, and adhering to robust organisational policies and procedures.⁶

Changes to and reviews of Victoria Police’s human source management practices since 2003

In 2003, Victoria Police introduced the Chief Commissioner’s Instruction 7/03 Informer Management Policy, the first comprehensive organisation-wide human source management policy that covered recruitment, registration, interaction, payment, deactivation and requests for assistance from human sources.⁷ The policy was intended, among other things, to encourage greater transparency, professionalism and security at all stages of the human source management process.⁸ Around the same time, Victoria Police established a centralised unit, now called the Human Source Management Unit (HSMU), with responsibility for overseeing the use of human sources managed by handling teams.⁹

Policy changes were introduced to reflect ‘best practice’ principles, such as maintaining a ‘sterile corridor’ where possible, to separate the management of a human source from the conduct of any investigations that used information obtained from the source.¹⁰ The use of a sterile corridor was thought to attract a number of benefits, such as protecting the identity of human sources and protecting the integrity of police methodology.¹¹ Victoria Police also began issuing an ‘Acknowledgement of Responsibilities’ (AOR) to human sources in 2003, setting out the terms and conditions of their relationship with the police.¹² These policy changes, as they relate to the current human source management framework, are discussed in Chapter 12.

In 2004, following a pilot program, Victoria Police established the Dedicated Source Unit, which later registered and managed Ms Gobbo as a human source.¹³ The Dedicated Source Unit was renamed the Source Development Unit (SDU) in 2006.

Further changes to Victoria Police’s human source management policy were not made until 2007. At this time, Victoria Police established a module in its intelligence and case management system, Interpose, for the electronic management of human source files.¹⁴ It also introduced specific requirements relating to the use of high-risk human sources (as determined in accordance with a risk assessment tool); for example, a requirement that handlers seek operational advice and assistance from the HSMU when engaging with such sources and that a sterile corridor be maintained at all times.¹⁵ Risk assessment processes were also strengthened.¹⁶

Following incremental changes in 2008 and 2010, the next significant set of reforms to policy were introduced in 2014 in response to the Comrie Review, as discussed below.

Many changes to Victoria Police’s human source management framework have arisen in response to internal and external reviews undertaken between 2001 and 2015. While focused on different events, officers and objectives, these reviews consistently highlighted failures, risks and deficiencies in Victoria Police’s human source management policies and practices. Key themes arising from the reviews included:

• insufficient management and supervision of officers responsible for handling human sources, creating risks of misconduct and corruption¹⁷
• the development of inappropriate and sometimes corrupt relationships between human sources and police officers¹⁸
• insufficient information management controls and leaking of sensitive and secretive information to criminal networks¹⁹
• a lack of compliance with Victoria Police’s human source policy among certain officers and units, including the use of ‘unregistered sources’²⁰
• a lack of sufficient safeguards and coverage of key issues within the policy framework²¹
• inadequate training of officers responsible for handling human sources.²²

The findings of these reviews are summarised in Figure 11.1 below. Some of the reviews, including the Kellam Report, were not published at the time of their completion, but redacted versions were later released as part of the proceedings in the Supreme Court of Victoria relating to the use of Ms Gobbo as a human source.²³

Figure 11.1: Reviews into Victoria Police’s human source management practices, 2001 to 2015²⁴

Reviews into the use of Ms Gobbo as a human source

Two of the reviews listed in Figure 11.1 examined the use of Ms Gobbo as a human source between 2005 and 2009 and focused particularly on issues arising from the use of human sources subject to legal obligations of confidentiality or privilege: the Comrie Review in 2012²⁵ and the Kellam Report in 2015.

The events that led to the Comrie Review and the Kellam Report are detailed in Chapters 1 and 6. The reviews are summarised below.

Comrie Review

On 19 March 2012, Victoria Police engaged former Chief Commissioner Neil Comrie, AO, APM to undertake a confidential review of the use of Ms Gobbo as a human source.²⁶ The Comrie Review assessed the adequacy of Victoria Police’s human source management policies that were in place in 2012 and applied those retrospectively to the handling of Ms Gobbo as a human source between September 2005 and January 2009.²⁷

The Comrie Review identified a number of issues relating to Victoria Police’s use of Ms Gobbo as a human source, including that risk assessment processes used were ‘grossly inadequate’, control measures were not complied with and registration processes were not as robust as they ought to have been.²⁸ The review concluded:

Whilst there may be some issues of concern within the Victoria Police processes, by far and above the most significant issues of concern [regarding the use of Ms Gobbo as a human source] would seem to relate to unsatisfactory management and supervision of process.²⁹

On 30 July 2012, the Comrie Review made 27 recommendations for reform of Victoria Police processes relating to the use of human sources, many of which had also been made in an earlier 2010 audit conducted by Victoria Police’s Corporate Management Review Division (CMRD) but had not been implemented.³⁰ The recommendations of the Comrie Review are detailed throughout this chapter insofar as they informed the Kellam Report recommendations.

Kellam Report

On 10 April 2014, Victoria Police made a notification to IBAC regarding the use of Ms Gobbo as a human source.³¹ Media at the time had reported on Victoria Police’s alleged use of a human source named ‘Lawyer X’.³²

IBAC appointed Mr Kellam to confidentially examine the conduct of current and former Victoria Police officers identified in the Comrie Review in relation to their use of Ms Gobbo as a human source, and the application and adequacy of Victoria Police policies, control measures and management practices during the period 2005–09.³³

The Kellam Report, completed on 6 February 2015, highlighted many of the same issues identified by the Comrie Review, including that:

• handlers had an imperfect understanding of the meaning and extent of legal privilege and confidential information³⁴
• handlers were not subject to sufficient oversight in their dealings with Ms Gobbo³⁵
• there was a lack of formal documentation that set out the key risks and boundaries of Victoria Police’s relationship with Ms Gobbo³⁶
• officers utilised their own subjective assessments to determine what was ethical and appropriate, in the absence of formal documentation.³⁷

Mr Kellam considered that Victoria Police’s receipt and use of confidential and privileged information provided by Ms Gobbo for the purpose of furthering police investigations against her clients, without having first obtained legal advice, was negligent.³⁸

Mr Kellam also suggested that the absence of early legal advice and the failure to establish strict parameters around the acquisition and use of information from Ms Gobbo may have resulted from ‘wilful blindness’ on the part of the SDU, which managed Ms Gobbo, and by those responsible for its oversight.³⁹ He surmised that, had there been adequate documentation to govern the relationship between Ms Gobbo and Victoria Police and a regular review of the risks involved, the need for appropriate legal advice would likely have become obvious and the risks that materialised would have been significantly reduced, if not eliminated.⁴⁰

Mr Kellam considered that any impropriety on the part of SDU officers was ‘substantially mitigated by the lack of guidance and supervision’ that they should have had from their superior officers.⁴¹ He concluded that the:

… conduct by individual police officers resulted not from any personal intention to act with impropriety on their part, but from what I consider to be behaviour constituting negligence of a high order on the part of those responsible for their supervision, guidance, instruction and management in the particular prevailing circumstances of obvious attendant risk.⁴²

The Kellam Report made 16 recommendations, many of which had been made earlier in the Comrie Review. These recommendations and the steps Victoria Police took to implement them are discussed below.

Implementation of the Kellam report recommendations

Since 2014, Victoria Police has made a series of policy changes to implement the recommendations of the Comrie Review and the Kellam Report. Victoria Police also provided information to the Victorian Government and IBAC about these changes in 2015 and 2018, as outlined in Figure 11.2.

Figure 11.2: Key dates and events in Victoria Police’s implementation of the Kellam Report recommendations, 2014 to 2020⁴³

In assessing Victoria Police’s implementation of the Kellam Report recommendations, the Commission considered:

• the intent, scope and context of the Kellam Report recommendations (and of the Comrie Review recommendations, where they informed the Kellam Report recommendations)
• the steps taken by Victoria Police to implement the Kellam Report recommendations and when this occurred
• the extent to which, based on the evidence available to the Commission, key Kellam Report recommendations were embedded in policy and translated into Victoria Police’s operational practice.

The Commission examined Victoria Police’s implementation of the Kellam Report recommendations primarily against the 2018 version of the Human Source Policy, as this was the policy document in place when the Commission was established in December 2018, until 4 May 2020, when a new policy came into effect.⁴⁴ Where relevant, this chapter reflects additional changes that Victoria Police made to address aspects of the Kellam Report recommendations in the current Human Source Policy.⁴⁵

The Commission’s inquiry was also informed by its audit of other human source files (discussed in Chapter 10) and focus groups held with Victoria Police officers who have human source management responsibilities (discussed in Chapter 12).

As noted above, the Kellam Report made 16 recommendations. These covered four areas:

• safeguards associated with the use of human sources with legal obligations of confidentiality or privilege (Recommendation 1)⁴⁶
• improvements to risk assessment practices (Recommendations 2 and 3)⁴⁷
• changes to Victoria Police policies and procedures for the day-to-day management of human sources (Recommendations 4–10)⁴⁸
• dissemination of the Kellam Report and amended Victoria Police policies to relevant parties (Recommendations 11–16).⁴⁹

Below the Commission addresses these four key areas, and the adequacy and timeliness of the implementation of recommendations.

Safeguards associated with legal obligations of confidentiality or privilege (Recommendation 1)

Recommendation 1 of the Kellam Report proposed that all Victoria Police human source policies, associated instructions and practice guidelines be revised to clearly reflect:

1. That special consideration applies to the obtaining, usage and management of information that may be subject to legal professional privilege and/or the subject of confidential information.
2. That the utmost caution ought to be exercised before engaging a human source who may have conflicting professional duties (eg lawyers, doctors, parliamentarians, court officials, journalists and priests etc).
3. That prior to the registration of any human source to whom a professional duty may apply, appropriate legal advice must be obtained.
4. That handlers should not actively seek information from human sources to whom a professional duty may apply if such information would cause the human source to breach such a duty knowingly.
5. That source handling and management duties provide no indemnification that would allow those performing such duties to disregard confidentiality notices that may be issued for IBAC, [Australian Criminal Intelligence Commission] or similar types of coercive hearings. Contravening such notices, in the absence of formal authority to do so, carries risk of criminal prosecution.⁵⁰

The Comrie Review made essentially the same recommendation in 2012, albeit referring only to privileged information, rather than privileged and/or confidential information.⁵¹

Mr Comrie advised the Commission that part (a) of this recommendation was intended to prompt the introduction of additional safeguards to manage the risk of obtaining privileged information from a human source, regardless of whether that person was themselves in an occupation bound by the relevant professional obligations.⁵² For example, a person who is not a lawyer, but has access to privileged information and seeks to provide that information to police, would—if managed in accordance with Mr Comrie’s recommendation—be subject to special consideration and safeguards.

Mr Comrie also confirmed that the references to specific professions in part (b) of the recommendation were examples only and not intended to be exhaustive.⁵³

As noted above, Mr Kellam endorsed these recommendations.

The nature and scope of legal obligations of confidentiality and privilege are discussed further in Chapter 4.

Changes to Victoria Police’s Human Source Policy

During the Kellam inquiry, and in response to the Comrie Review recommendations, Victoria Police updated its Human Source Policy in 2014 to include provisions stating that:

• The HSMU must be contacted for advice when a member becomes aware, through the course of their duties, that
  • an active or deactivated human source is to be the subject of a compulsory hearing before an [authorised] examiner (OCE, ACC, IBAC etc,); and
  • the examination may adversely affect the human source or an investigation

...

• Where complex, legal, ethical or medical considerations are evident with a human source, such as the human source being occupationally bound by other duties … advice must be sought from the HSMU.
• Members must be mindful that some sources as a result of their occupations may have professional obligations regarding confidentiality eg. Lawyers, Doctors and Clergy
• Handlers must consider the legal and ethical implications for the management of these sources and the information or intelligence they transmit in compiling their registration applications.
• Members must obtain advice from HSMU management as to the method of handling and recording of any such information or intelligence that may conflict with the professional obligations of the source

...

• The HSMU will obtain advice from Legal Services [Department] regarding the quarantine or use of information or intelligence obtained which may breach a professional obligation.
• The strict adherence of this policy is not intended to discourage the use of high-risk sources in such circumstances but to effectively manage the relationship and information obtained in accordance with acceptable legal and community standards.⁵⁴

In May 2018, Victoria Police further reframed its Human Source Policy to refer to the specific occupations included as examples in the Kellam Report and Comrie Review, described by Victoria Police as the ‘Kellam Occupations’. Under the policy, Victoria Police officers were required to be ‘mindful’ that some sources may have professional or ethical obligations regarding confidentiality, specifically ‘lawyers, doctors, parliamentarians, court officials, journalists and priests etc’.⁵⁵ Further, it prohibited handlers from actively seeking information from ‘sources to whom a professional obligation may apply if such information would cause the human source to breach such a duty knowingly’.⁵⁶

The updated Human Source Policy 2018 also required that applications to register human sources with legal obligations of confidentiality or privilege be referred to the Ethics Committee for review and a decision.⁵⁷ It also expanded instructions for officers on how to manage human sources who had appeared (or were to appear) before coercive or compulsory hearings before law enforcement agencies such as IBAC or the Australian Criminal Intelligence Commission. This included advice on how to manage the risk of obtaining information subject to a confidentiality notice.⁵⁸

The policy referred to the existence of certain laws and rules requiring confidentiality, such as legal privilege and the medical Hippocratic oath.⁵⁹ It did not include further guidance about how to identify confidential and privileged information or explain the laws and rules that apply to specific persons or occupations.

The Human Source Policy 2018 did not contain requirements relating to human sources in other occupations that may be subject to legal or ethical obligations of confidentiality or privilege (that is, occupations that fell outside the ‘Kellam Occupations’). Nor did the policy address the risks of obtaining or using confidential or privileged information from human sources who were not themselves in an occupation subject to legal obligations of confidentiality or privilege but were sharing such information (for example, a friend or family member of a lawyer who provided police with privileged information obtained from the lawyer).

In a statement to the Commission, then Assistant Commissioner Neil Paterson, APM, Intelligence and Covert Support Command, advised that a prospective human source who is not themselves bound by legal obligations of confidentiality or privilege, but who may access confidential or privileged information, would also be referred to the Ethics Committee under the Human Source Policy 2018.⁶⁰ In the absence of a clear policy direction, however, it is unclear how officers would have been prompted to make this referral.

Changes to Victoria Police’s Interpose System

Victoria Police uses Interpose to record information relating to the registration of human sources, their contact with police officers, and officers’ dissemination of intelligence received from human sources.

In October 2019, Victoria Police updated Interpose to support the identification of legal obligations of confidentiality or privilege during the process of registering a human source.⁶¹ These changes included a series of questions that officers must answer when seeking to register a person as a human source, as outlined in Box 11.1.⁶²

Mr Paterson advised the Commission that the new features in Interpose enable the HSMU to actively monitor new registrations and to report any issues to the Central Source Registrar (CSR) and the Ethics Committee.⁶⁷

Currently, Interpose does not support the identification of circumstances where a prospective human source is not in an occupation subject to legal obligations of confidentiality or privilege, but nonetheless has access to, and may provide, confidential or privileged information.⁶⁸

Through focus groups with Victoria Police officers and an audit of selected human source files, the Commission considered the practical effect of the policy and system changes outlined above.

The Commission’s audit highlighted inconsistencies in officers’ identification and management of potential legal obligations of confidentiality or privilege when considering and registering human sources. In several cases, Victoria Police officers did not identify potential obligations of confidentiality or privilege; in other cases, these obligations tended to be identified later in the process by the HSMU or the CSR, rather than by the handler seeking to register the person.

Observations from the Commission’s focus groups with Victoria Police officers are outlined in Box 11.2.

Changes introduced during the Commission’s inquiry

In May 2020, Victoria Police issued a new version of the Human Source Policy, which requires Ethics Committee approval not only for the use of prospective human sources employed within a ‘Kellam Occupation’—defined in the Human Source Policy as Category 1 sources— but also for people who have a ‘connection to’ one of these occupations.⁶⁹ These are people who:

• previously worked in a Kellam Occupation
• are likely to receive confidential or privileged information from someone in one of these occupations; or
• work in a similar occupation where they are likely to receive confidential or privileged information.⁷⁰

These types of human sources are explained in Chapter 12. The Human Source Policy does not contain guidance on how to identify these individuals.

In a statement to the Commission in April 2020, Deputy Commissioner Wendy Steendam, APM, Specialist Operations, stated that training courses were being revised to assist officers with the identification of human sources with a legal obligation of confidentiality or privilege, as well as those with a connection to these persons.⁷¹

The current Human Source Policy removed the requirement introduced in earlier versions to address Recommendation 1(d)—that officers must not actively seek information from human sources that would knowingly cause the human source to breach a professional obligation. Ms Steendam told the Commission that, notwithstanding the removal of this provision, ‘the extensive registration approval requirements’ contained in the policy make clear to officers that in ‘almost no circumstances’ should they seek information from a human source with legal obligations of confidentiality or privilege.⁷²

Improvements to risk assessment practices (Recommendations 2 and 3)

Risk assessments are intended to identify all known or potential risks associated with a prospective human source, to help determine whether their registration and use as a human source is appropriate. Reviewing risk assessments on an ongoing basis after a human source has been registered helps to inform Victoria Police about whether to continue using the human source or deactivate them.⁷³

Prior to the completion of the Kellam Report, Victoria Police’s Human Source Policy required risk assessments for each source registration to be documented, comprehensive, and subject to a formal and ongoing monthly review.⁷⁴ Despite this, as the Kellam Report notes, there were only two documented risk assessments on Victoria Police’s file relating to its use of Ms Gobbo as a human source between 2005 and 2009.⁷⁵

Mr Kellam found that the risk assessments completed in relation to Ms Gobbo were insufficient, with neither referring to the potential ethical and legal issues associated with using a criminal defence barrister as a human source.⁷⁶ These observations were consistent with the findings of the Comrie Review.⁷⁷

Both the Comrie Review and the Kellam Report recommended that Victoria Police develop a more robust human source risk assessment process to address identified shortcomings.

Recommendation 2 of the Kellam Report was based on a recommendation in the Comrie Review, which was in turn based on findings of an internal review of Victoria Police’s human source management practices, conducted by the CMRD in 2010.⁷⁸

Recommendation 2 stated that the:

… lack of risk assessment insight, and lack of revisiting risk assessments must be the subject of sustained remedial action, and … regular periodic review and regular audit and for more detailed and proximate oversight by senior officers than was the case under consideration in this inquiry.⁷⁹

Recommendation 3 of the Kellam Report required Victoria Police’s risk assessment processes to be amended to ensure:

1. Clear particularisation of the purpose for engagement of the human source and instructions that if there is any change to this purpose, or any form of ‘bracket creep’ in original intentions, then a new and full risk assessment process must be undertaken.
2. That where complex legal and ethical considerations are evident, such as the source being bound occupationally by other ethical responsibilities, then consultation must occur with the [Victoria Police] Director Legal Services or Victorian Government Solicitor prior to completion of the risk assessment process.
3. That where other complex issues are recognised, such as health or mental health matters, then appropriate professional advice is obtained.
4. That any risk assessment reliant on positive obligations to utilise a source must be subjected to the utmost scrutiny to reflect upon the issues of proportionality and necessity. Positive obligation reliance must be for [a] specific purpose only and approval must lapse upon fulfilment of this purpose. Where positive obligations are to be relied upon consultation must first occur with the [Victoria Police] Director Legal Services.
5. That source registration cannot occur until the Local Source Registrar (LSR) has endorsed the risk assessment document to indicate their satisfaction that all perceivable risks have been identified, that the risk controls are sufficient and that any change to risk profile must trigger a new risk assessment process.
6. That for high-risk source cases the [LSR], as a component of the monthly inspection process, must endorse current risk assessments to reflect that no new risks have arisen that would require a revised risk assessment being conducted and that the current risk assessment remains fit for purpose. The LSR must also document the checks and inquiries undertaken in order to make such a determination.
7. That for high-risk source cases there is sufficient capability and capacity to service the relationship and maintain reporting requirements.⁸⁰

The concept of ‘positive obligation’ is explained below.

According to Victoria Police, all aspects of these recommendations were implemented through:

• changes to the Human Source Policy in September 2014
• a revised ‘Human Source Risk Assessment’ template implemented in May 2015
• clarifying amendments incorporated in the Human Source Policy 2018.⁸¹

Under both the Human Source Policy 2014 and Human Source Policy 2018, human sources with occupations attracting legal obligations of confidentiality or privilege were automatically regarded as high-risk.⁸²

The Human Source Policy 2018 required:

• Risk assessments to clearly articulate the purpose for engaging a human source and a full new risk assessment to be undertaken, if there was any change to that purpose or any movement from original intent.⁸³
• Decisions regarding human source management that had strategic implications, involving complex ethical, legal or medical issues, to be referred to the Ethics Committee for consideration, which could obtain relevant legal advice.⁸⁴
• As part of the approval process for human sources, advice to be obtained from the HSMU where complex medical considerations were evident or where a human source had medical or mental health issues. In those circumstances, the HSMU was required to obtain advice from a medical officer or psychologist.⁸⁵
• Advice to be obtained from the HSMU where a registered human source, who was in a position to which confidentiality obligations or professional privilege applies, voluntarily offered information to police that was or appeared to be in breach of that privilege. The HSMU was required to obtain legal advice.⁸⁶

Other aspects of Recommendation 3 and the steps Victoria Police took to implement the recommendation are outlined below.

‘Positive obligation’

As noted above, the Comrie Review and Kellam Report recommended that Victoria Police’s revised processes ensure that risk assessments relying on a positive obligation to use a human source ‘must be subjected to the utmost scrutiny to reflect upon the issues of proportionality and necessity’.⁸⁷ The concepts of necessity and proportionality are discussed below.

In the context of risk assessments, a positive obligation arises where Victoria Police considers it has a duty to act on information for the broader protection of the community.⁸⁸

The term was first referred to in the Comrie Review when detailing the two documented risk assessments on file for Ms Gobbo.⁸⁹ The Comrie Review suggested the content of these risk assessments could imply that Victoria Police was prepared to justify its engagement of Ms Gobbo regardless of any recognisable moral and legal barriers or other risks.⁹⁰ It noted a provision of a policing manual used at the time as a possible basis used by officers to justify the views articulated in the risk assessments related to Ms Gobbo’s registration and use as a human source. This provision read:

Positive obligation to use or register source

1. Will the decision not to use or register the Human Source increase the risks to the public? ⁹¹

Mr Comrie considered that this provision was poorly and incompletely expressed and that a positive obligation to act on information (that is, to protect the community) should not be interpreted as giving just cause to override other considerations, such as the legality of actions.⁹² Both the Comrie Review and Kellam Report recommended that risk assessments that rely on a positive obligation to register a human source must be for a specific purpose only, that approval must lapse upon fulfilment of that purpose and that consultation must first occur with the Director of Victoria Police’s Legal Services Department.⁹³

The recommendation applied to risk assessments relying on a positive obligation in respect of any human source. It was not directed specifically to those human sources subject to legal obligations of confidentiality or privilege.

On 26 June 2015, in its reporting on the implementation of the Kellam Report recommendations, Victoria Police advised IBAC that it understood that a positive obligation ‘relates to a need to register a human source in circumstances where a failure to do so could result in serious harm to members of the public, even though the source may represent an unacceptable risk in normal circumstances’.⁹⁴

The Human Source Policy 2015 did not refer to the term positive obligation. The Ethics Committee’s original terms of reference, dated 19 March 2015, referred to its role in reviewing the registration of human sources in cases where a positive obligation exists, though this provision was later removed.⁹⁵

The term was first explicitly referenced in the Human Source Policy 2018.⁹⁶ In place until 4 May 2020, the policy contained the following provision:

The definition of positive obligation is ‘where information is provided by a source who is bound by legislation or rules of their profession (i.e. legal/professional privilege, medical Hippocratic oath) or provided in circumstances where Victoria Police would not normally accept the information, but which is of such high community impact that it is proportionate and necessary to be utilised’.⁹⁷

The policy also specified that where a positive obligation applies, legal advice is to be obtained, and decisions are to be escalated to the Ethics Committee for endorsement.⁹⁸

The Human Source Policy 2018 did not include further information or guidance about the term or how officers responsible for human source management were expected to identify the existence of a positive obligation.

In late 2019, Mr Paterson advised the Commission that Victoria Police intended to remove the term ‘positive obligation’ from its Human Source Policy because it was not well understood by officers.⁹⁹ The term was removed in May 2020.

Although the current Human Source Policy does not specifically refer to a duty on Victoria Police to act on information provided by a human source, it refers to a category of people whom Victoria Police ‘would not ordinarily register’ but whom an officer wants to register because the information is of ‘extraordinarily high value’.¹⁰⁰ The Human Source Policy does not define information that is of ‘extraordinarily high value’.

Assessment of necessity and proportionality and human rights

In his report, Mr Comrie considered that:

• any positive obligation identified by Victoria Police needed to be considered against whether it was necessary and proportionate to register and use a human source
• in order to undertake a meaningful assessment of necessity and proportionality, the reasons for registering a source and the purpose of doing so would need to be documented.¹⁰¹

The Comrie Review drew upon the concepts of necessity and proportionality that apply to the United Kingdom’s human source management framework, which operates alongside statutory human rights obligations.¹⁰² These concepts are broadly comparable with Victoria Police’s obligations under the Charter of Human Rights and Responsibilities Act 2006 (Vic) (Charter) to ensure that a ‘human right may be subject under law only to such reasonable limits as can be demonstrably justified in a free and democratic society’.¹⁰³

The concepts of necessity and proportionality first appeared in Victoria Police’s Human Source Policy in 2018. As noted above, a provision was introduced into the policy to require Ethics Committee approval in cases involving complex legal, ethical or medical issues, to ensure that registrations of such human sources were necessary and proportionate.¹⁰⁴ No further information was included to define these terms or to explain how police officers ought to have considered these concepts in conducting risk assessments of prospective human sources.

In her evidence to the Commission, Ms Steendam stated that officers’ obligations to consider human rights and comply with the Charter are also set out in the Victoria Police Manual Policy Rules—Human Rights Equity and Diversity Standards (Human Rights Standards).¹⁰⁵

The Human Rights Standards explain that when making decisions, officers must consider whether:

• there is a reason for acting and under what law or authorisation the action will occur
• police action will protect or limit human rights
• any limit to human rights is reasonable and can be justified in the circumstances, including having regard to whether the limitation is specifically authorised by law and whether it is for a legitimate purpose
• the limitation is necessary and proportionate to the intended goal
• there is another reasonable way of achieving the goal that is less restrictive of human rights and whether it can be done better or differently.¹⁰⁶

The 2014, 2015, 2016, 2018 and 2020 versions of the Human Source Policylist various policy and procedural documents that are related to and should be read in conjunction with the Human Source Policy. The Human Rights Standards are not listed.

Victoria Police’s human rights obligations in the context of human source management practices are discussed further in Chapter 12.

Review of risk assessments

Recommendation 3(e) and 3(f) of the Kellam Report were specifically targeted at strengthening supervision and internal oversight of risk assessments.

During the Kellam inquiry and in response to the Comrie Review, Victoria Police amended the Human Source Policy in September 2014 to require the Local Source Registrar (LSR) to:

• assess the suitability of a prospective human source for registration
• review the risk assessment to make sure it is comprehensive, evaluates potential and identified risks and indicates that appropriate mitigation strategies are in place
• review the AOR
• make a recommendation about approval of the registration, taking into consideration all factors identified in the human source registration file
• document the reasons for their recommendation.¹⁰⁷

Additional changes introduced in March 2016 required LSRs to ensure risk assessments were complete within timeframes specified in the Human Source Policy. They also required the LSR to endorse that the risk assessment

remained fit for purpose on a monthly basis and in doing so, record in Interpose the ‘checks and inquiries undertaken in order to make such a determination’.¹⁰⁸

Information provided to the Commission during its inquiry indicated that low compliance with policy requirements relating to risk assessments and the ongoing review of assessments was an area of concern to Victoria Police. A draft internal strategy document prepared in 2018 pointed to perceptions within Victoria Police that the risk assessment process was bureaucratic and contributed to police officers running human sources ‘off the books’—that is, deciding not to register people as human sources but nonetheless engaging with them as though they were human sources.¹⁰⁹

The Commission considered the practical impact of the changes to Victoria Police’s risk assessment processes through its audit of selected human source files and focus groups with Victoria Police officers.

Observations from the Commission’s audit and focus groups are outlined in Boxes 11.3 and 11.4.

Changes introduced during the Commission’s inquiry

The Human Source Policy issued in May 2020 contains some guidance for police officers about human rights relevant to human source management.¹¹⁰ The Ethics Committee’s current terms of reference also outline the factors taken into account when considering the proposed registration of a human source and Victoria Police’s human rights obligations.¹¹¹

On 30 October 2019, Mr Paterson approved a pilot program to trial a dynamic risk assessment tool for human sources to assist in identifying and managing changes in a human source’s risk once they have been registered.¹¹²

Victoria Police also informed the Commission that it is updating its initial risk assessment template, with the intention to have it fully implemented by December 2020.¹¹³ These untested aspects of Victoria Police’s practices are discussed further in Chapter 12.

Changes to Victoria Police policies and processes for the day-to-day management of human sources (Recommendations 4–10)

Recommendations 4–10 of the Kellam Report related to changes to Victoria Police policies and processes for the day-to-day management of human sources; in particular:

• preparation of an AOR
• mental health and wellbeing of a human source
• tasking of a human source
• dissemination of Information Reports (IRs)
• independent review of high-risk human source files and records
• engagement of a human source by other police officers
• transition of a human source to a witness.

These recommendations are discussed in turn below.

Preparation of an Acknowledgement of Responsibilities

An AOR has been required under Victoria Police policy since 2003. As noted earlier in this chapter, an AOR is issued to human sources and sets the boundaries of the relationship between Victoria Police and the human source.

The Kellam Report noted that the unexplained absence of an AOR to govern the relationship between Ms Gobbo and Victoria Police ‘meant that multiple persons dealing with the source were required to utilise their own, possibly differing, subjective assessments in determining what was ethical and appropriate in any particular circumstance’.¹¹⁴

Recommendation 4 of the Kellam Report required:

That human source policies and instructions reflect that the sufficiency of the AOR must be the subject of constant evaluation, with additional instructions being documented and reinforced with the source as may be necessary.¹¹⁵

The Comrie Review had previously made the same recommendation.¹¹⁶

Victoria Police advised that this recommendation was initially implemented in 2014 by an amendment to its Human Source Policy.¹¹⁷Further clarifying amendments were made in 2015 and 2018.¹¹⁸

The Commission’s review of Victoria Police’s policy framework indicated that this recommendation appears to have been implemented consistently with the intention of the Kellam Report recommendation.

Mental health and wellbeing of a human source

The Kellam Report noted that then Assistant Commissioner Simon Overland, APM and all members of the SDU involved in the management of Ms Gobbo were aware that she had provided Victoria Police information that was confidential or privileged.¹¹⁹ Despite this, the ‘majority of those members considered that the issue was a matter for which [Ms Gobbo] bore ultimate responsibility’, while also recognising that the existence of mental health issues may have impaired Ms Gobbo’s judgement.¹²⁰

Indeed, at one point, officers had identified that a psychological assessment and review of the viability of using Ms Gobbo as a human source was needed, although this assessment did not eventuate.¹²¹

Consequently, Recommendation 5 of the Kellam Report required:

That policies and procedures are developed to guide actions where significant psychological issues are apparent or are perceived to exist with a human source. These policies and procedures must ensure escalation of such issues to source registrar level and also ensure that where appropriate professional psychological advice is obtained and given proper regard.¹²²

Victoria Police advised that this recommendation was implemented in March 2016 through the following amendment to its Human Source Policy:

Where significant psychological or medical issues are apparent or are perceived to exist at any stage of the human source registration or management process HSMU must seek advice from [Victoria Police’s] Psychology Services or a Forensic Medical Officer at [the Victorian Institute of Forensic Medicine] and provide that advice both to the LSR and CSR for consideration and proper regard.¹²³

The above advice was also reflected in the Human Source Policy 2018. Neither policy included further information about the purpose of this advice or how police officers should consider any issues of consent and confidentiality that might emerge.

In May 2020, Victoria Police introduced a ‘Mental Health Functioning Screen’ to assist police officers in identifying potential indicators that may suggest a prospective human source has a serious mental health condition. While this is consistent with the Kellam Report recommendation and appears to provide a more robust framework for considering and responding to potential mental health issues, the Mental Health Functioning Screen is a new and untested aspect of Victoria Police’s policy framework.

Observations drawn from the Commission’s audit of human source files that relate to this Kellam Report recommendation are outlined in Box 11.5.

Tasking of a human source

At various points after mid-2006 while Ms Gobbo was registered as a human source, Victoria Police management decided that, to manage the associated risks, no ‘tasking’ of Ms Gobbo by police was to occur.¹²⁴ Despite this, Ms Gobbo continued to be in regular contact with Victoria Police, providing information about her clients and their associates. As the Kellam Report noted, there was an absence of clear operational boundaries as to whether this constituted tasking.¹²⁵

Recommendation 6 of the Kellam Report required:

That [Victoria Police] settle and publish within [its] human source policy a clear and unambiguous definition of what constitutes ‘tasking’ and ensure that this definition is brought to the attention of all personnel involved in human source operations.¹²⁶

Victoria Police advised that this recommendation was implemented in March 2016 by an amendment to its Human Source Policy.¹²⁷ It further clarified the definition of ‘tasking’ in an update to its policy in April 2018.

According to the Human Source Policy 2018, tasking is:

… any assignment or instruction given to the human source by the handlers. This includes asking the human source to obtain information, to provide access to information or to otherwise act, incidentally, for the benefit of [Victoria Police].¹²⁸

The Commission’s review of Victoria Police’s policy framework indicated that this recommendation appears to have been implemented consistently with the intention of the Kellam Report recommendation.¹²⁹

Dissemination of Information Reports

The Kellam Report referred to a number of instances where information provided to Victoria Police by Ms Gobbo was verbally disseminated by SDU officers to other police units and was not documented in an IR for some time— on some occasions, months or years after it was initially disseminated.¹³⁰

Up-to-date IRs, among other things, enable supervising officers to scrutinise the use of a human source by the officers engaging with the source, and delayed finalisation of an IR impedes the capacity of supervising officers to provide this oversight.

Recommendation 7 of the Kellam Report required:

That Human Source Management policies and instructions reflect that in any instance where as a result of information being provided by a human source, oral advice is disseminated to another area of [Victoria Police], such actions are to be fully documented in an expeditiously submitted Information Report.¹³¹

Victoria Police indicated that this recommendation was implemented in March 2016, more than a year after it was made in the Kellam Report and over four years after a similar recommendation was made by the Comrie Review.¹³²

The Commission’s review of Victoria Police’s policy framework indicated that this recommendation appears to have been implemented consistently with the intention of the Kellam Report recommendation.

Independent review of high-risk human source files and records

Recommendation 8 of the Kellam Report required:

That a process of independent and appropriately skilled case officer assessments be established to provide for frequent, comprehensive and accountable review of all high-risk human source files and records.¹³³

Victoria Police advised the Commission that this recommendation was implemented in March 2016 by an amendment to its Human Source Policy, with further minor refinements made in April 2018.¹³⁴

Under the Human Source Policy 2018, the HSMU was required to, ‘in consultation with the CSR, undertake frequent, comprehensive and accountable reviews of all human source files and records’.¹³⁵

The Commission’s review of Victoria Police’s policy framework indicated that this recommendation appears to have been implemented consistently with the intention of the Kellam Report recommendation.

Engagement of a human source by other police officers

The Kellam Report reflected that many witnesses examined during its inquiry had identified the potential for a ‘loss of control’ as a consistent theme in the relationship between Ms Gobbo and Victoria Police.¹³⁶ Mr Kellam observed that this theme was evident in the use of Ms Gobbo as a human source by various taskforces.¹³⁷ Recommendation 9 of the Kellam Report required:

That in any instance where it is contemplated that a human source is to be engaged by other police in order to secure evidence an appropriate management plan must first be compiled. Such a plan should clearly articulate roles, responsibilities and management arrangements and also include a full risk assessment process. The plan should also endeavour to extract the maximum benefits available from all learnings derived to date from source interaction.¹³⁸

Victoria Police considered this recommendation was introduced in September 2014.¹³⁹

The Commission’s review of Victoria Police’s policy framework indicated that some aspects of this recommendation were implemented. The Human Source Policy 2014 required a management plan to be created in these circumstances, clearly articulating roles and arrangements, and a new risk assessment to be developed.¹⁴⁰

Transition of a human source to a witness

Ms Gobbo was deregistered as a human source in January 2009 in order to act as a witness in a criminal trial.

The Kellam Report noted that ‘the decision to use [Ms Gobbo] as a witness was fraught with danger to both [Ms Gobbo] and to the proposed prosecution and to the good repute of and confidence by the community’ in Victoria Police.¹⁴¹ Mr Kellam indicated that the dangers associated with the use of Ms Gobbo as a witness were not adequately considered and that they ought to have been.¹⁴²

As a result, Recommendation 10 of the Kellam Report required:

That [Victoria Police] develop a process to be activated when it may be contemplated that a human source may be required to become a witness. This process should include the compilation of a source to witness transition management plan which encompasses:

1. Comprehensive legal advice and the involvement of the [Victoria Police] Director Legal Services.
2. Full risk assessments and briefing notes (both from source managers and from the particular investigators).
3. [Witness Security Unit] program suitability and economic impact assessments (if protected witness issues are perceived to exist or to be likely).

An appropriate high-level committee should be convened to make accountable decisions in regard to proposed transitions. Representation on this committee should include senior management having responsibility for human source operations, the particular investigation and, where appropriate, [the Witness Security Unit].¹⁴³

Victoria Police advised the Commission that this recommendation was implemented in May 2018 by an amendment to its Human Source Policy, some three years after the recommendation was made.¹⁴⁴

The Commission’s review of the Human Source Policy 2018 indicated that most aspects of the recommendation were incorporated in the policy framework in May 2018.¹⁴⁵ The Human Source Policy 2018 reflected the role of the Ethics Committee to consider proposals to transition high-risk human sources to witnesses.¹⁴⁶ The Kellam Report recommendation, however, was directed at all human sources. It was not confined to high-risk sources such as those with legal obligations of confidentiality or privilege.

The Human Source Policy now applies the same witness transition processes to all human sources, regardless of their risk classification, which appears to fulfil the intention of the recommendation.

Dissemination of the Kellam Report and amended Victoria Police policies to relevant parties (Recommendations 11–16)

Recommendations 11–16 of the Kellam Report required Victoria Police to report back to IBAC on consequential amendments to its Human Source Policy, and to disseminate the Kellam Report and its annexures to third parties.

Adoption and implementation of the recommendations

Recommendation 11 of the Kellam Report required:

That in the event that any part of the aforesaid recommendations has already been implemented that copies of any amended policies, guidelines and amendment to manuals in consequences thereof be provided to IBAC.¹⁴⁷

In addition, Recommendation 15 specified:

Recognising that the Chief Commissioner of Police may well have adopted many of the above recommendations subsequent to the provision of the Comrie Review, the Chief Commissioner of Police [should] inform the Commissioner of IBAC whether or not any such recommendations have been adopted and implemented, and otherwise to provide a report to IBAC under section 161 of the IBAC Act.¹⁴⁸

In June 2015, Victoria Police wrote to IBAC confirming that it had ‘adopted’ all recommendations of the Kellam Report.¹⁴⁹ In doing so, Victoria Police explained the steps it had taken to implement the Kellam Report recommendations and provided IBAC with copies of the Human Source Policy issued in June 2015, the new Human Source Risk Assessment template and the Ethics Committee terms of reference.

In May 2019, Victoria Police wrote to IBAC again after issuing a new Human Source Policy in May 2018, advising that all of the recommendations of the Kellam Report had been ‘acquitted’.¹⁵⁰

Despite the advice Victoria Police provided to IBAC, the Commission’s inquiry has indicated that not all of the recommendations were fully implemented by May 2018. This is discussed further below.

Dissemination of the Kellam Report

Recommendations 12, 13 and 14 of the Kellam Report related to the dissemination of the Kellam Report to third parties.

Recommendation 12 required:

That the Chief Commissioner of Police provide a copy of this report, (including its annexures) together with such other material as he may consider appropriate to the Director of Public Prosecutions for consideration at the highest level, as to whether any prosecutions conducted by the [Director of Public Prosecutions] in the past and based upon evidence provided by [Victoria Police], which evidence may have been obtained by reason of breach of legal professional privilege or release by the Source of other confidential material has resulted in a miscarriage of justice.¹⁵¹

In addition, Recommendation 13 required that a copy of the Kellam Report and its annexures be provided to the Minister for Police and Recommendation 14 required that a copy of the report be provided to the then Inspector of the Victorian Inspectorate, Mr Robin Brett, QC.¹⁵²

Evidence before the Commission indicates that Victoria Police provided the Director of Public Prosecutions a copy of the Kellam Report and most of its annexures on 13 February 2015.¹⁵³

Victoria Police did not provide a copy of the Kellam Report and annexures to the Minister for Police or the Victorian Inspectorate, on IBAC’s advice that it had already provided the Minister and Inspector with a copy of the report.¹⁵⁴ It appears that there was an oversight in that the annexures to the report were not provided to the Minister for Police by either IBAC or Victoria Police.

In addition, Recommendation 16 of the Kellam Report required:

That this report should be accorded the highest level of confidentiality by all persons to whom it is disseminated. Failure to accord such confidentiality would be highly likely to increase the already significant danger to the life of the Source referred to in this report.¹⁵⁵

There is no information before the Commission to indicate Victoria Police or any other body did not apply the highest level of confidentiality to the Kellam Report.

The adequacy and timeliness of implementation

Victoria Police considers that substantial and timely changes have been made since the use of Ms Gobbo as a human source and the completion of the Kellam Report.

Ms Steendam explained:

As with all organisations, Victoria Police’s processes, policies and systems have continued to evolve and improve over time. As a result, very many of the issues relevant to the recruitment and use of Nicola Gobbo are of their time and have already been dealt with through organisational changes and developments. Equally, Victoria Police has made substantial changes to its management of human sources in response to the Comrie Review and the Kellam Report.

…

Changes in order to prevent these issues occurring again have already been implemented through changes in regulation, governance, policy and oversight of human source management within Victoria Police.¹⁵⁶

In a submission to the Commission in August 2020, Victoria Police stated that all Kellam Report recommendations were implemented within six months of receipt and that these amendments reflected best practice at the time.¹⁵⁷

Victoria Police suggested that the additional policy changes introduced since 2015 reflect the evolving nature of its risk management framework for the use of human sources and further, that they are ‘evidence of Victoria’s commitment to best practice’ and ‘policy of continuous improvement’, rather than emblematic of any deficiency in its response to the Kellam Report recommendations.¹⁵⁸

Policy development and change management

As part of its examination of Victoria Police’s implementation of the Kellam Report recommendations, the Commission considered the manner in which Victoria Police developed and managed the changes to its policies and practices.

Change management can be described as:

… the application of processes and tools to manage the people side of change from a current state to a new future state so that the desired results of the change (and expected return on investment) are achieved.¹⁵⁹

The Victorian Public Sector Commission is a statutory authority established to improve the performance of the Victorian public sector and assist it to provide services effectively and efficiently. It has indicated that communication with employees impacted by or expected to apply a change to policy is important to maintain clarity, consistency and accuracy of information.¹⁶⁰ Where appropriate and possible, management should consult with staff and relevant stakeholders to identify options to achieve the outcomes intended through policy change.¹⁶¹ In order for change to be effective, the Victorian Public Sector Commission recommends ongoing monitoring and review following implementation.¹⁶²

Victoria Police’s Capability Plan 2016–2025 sets out its goal to be an effective, agile, responsive, people-focused and connected organisation.¹⁶³ The plan highlights the need for Victoria Police to become more proficient in change management.¹⁶⁴

The sections below discuss the governance and review structures Victoria Police put in place to address the findings and recommendations of the Comrie Review and Kellam Report and test the effectiveness of change, and how it engaged with and trained officers responsible for human source management to support policy development and implementation.

Governance and review structures

Following the completion of the Comrie Review, Victoria Police established two taskforces to manage issues arising from its use of Ms Gobbo as a human source; however, neither focused on overseeing all changes arising from the Comrie Review and Kellam Report.¹⁶⁵

As noted earlier in this report, during the Kellam inquiry and in response to the Comrie Review recommendations, Victoria Police implemented various changes to its Human Source Policy in September 2014. In January 2015, Victoria Police tasked its Internal Audit Unit to review the implementation of the recommendations arising from the audit conducted by Victoria Police’s CMRD in 2010, many of which were repeated in the Comrie Review.

After completion of the Kellam Report in 2015, the scope of the Internal Audit Unit review was expanded to consider the effectiveness of new controls embedded in the Human Source Policy.¹⁶⁶ The outcomes of this review are outlined below.

Findings of the Internal Audit Unit review

The Internal Audit Unit was provided access to the Comrie Review to identify findings that underpinned the recommendations and a list of the recommendations from the Kellam Report.¹⁶⁷

The Internal Audit Unit review found that:

• despite having implemented recommendations from the 2010 CMRD audit, Comrie Review and Kellam Report, compliance with the Human Source Policy across the organisation was ‘unsatisfactory’
• the absence of an organisational human source strategy within Victoria Police to support specific objectives and to consider system as well as policy implications was leading to inconsistent practices
• a series of changes to the Human Source Policy arising from these reviews had led to the policy becoming ‘too prescriptive’ and had led to increased non-compliance.¹⁶⁸

Advice on policy changes

Alongside the Internal Audit Unit’s review, on 22 April 2015, Victoria Police obtained legal advice about proposed changes to the Human Source Policy. This advice indicated that the policy should highlight the need for police officers to consider issues of confidentiality or privilege that might arise outside of dealing with a human source subject to occupational obligations of confidentiality or privilege. The advice noted the potential for confidential or privileged information to be obtained by police from a person not themselves in an occupation subject to these obligations (for example, a partner or close family member of a lawyer).

The advice stated that:

While a duty of confidentiality arises as a professional obligation between a professional person and their client, the information does not lose its confidential status if disclosed to another. Even the recipient of wrongly disclosed confidential information can be compelled by law to keep that information confidential.¹⁶⁹

This advice also noted that the group of occupations with obligations of confidentiality or privilege is broader than what the Human Source Policy reflected, pointing to confidentiality obligations that can attach to trade or business.¹⁷⁰ While Victoria Police incorporated changes to reflect some issues raised in the advice, neither of the matters relating to confidential or privileged information were addressed in the Human Source Policy until May 2020.

Consultation, communication and training

Between 2014 and 2018, Victoria Police officers responsible for applying the Human Source Policy were informed of policy changes arising from the Kellam Report via the internal Victoria Police ‘Gazette’, emails to handlers and the provision of a version of the new Human Source Policy with sections highlighted to illustrate what had been added or removed.¹⁷¹

It appears that Victoria Police did not consult more broadly with officers involved in human source management as part of its development of changes to the Human Source Policy in 2014, 2015, 2016 and 2018.

Ms Steendam, on behalf of Victoria Police, explained that for more specialist functions such as human source management, Victoria Police consults officers who practise and work in that specific field.¹⁷² She also indicated that Victoria Police has a ‘structured approach for policy development’,¹⁷³noting that:

[p]olicy is developed as part of a process of continuous improvement and to adapt to new and emerging issues within [Victoria Police’s] operating environment.¹⁷⁴

According to Ms Steendam, this approach means that where there is ‘legislative change, issues identified, rifts identified or gaps in the policy,’ Victoria Police takes steps to ‘continuously improve’ those policies.¹⁷⁵

Mr Paterson also described Victoria Police’s approach to policy development as ‘a continual process where current policies are frequently reviewed and updated as necessary’. He explained that this is particularly the case with the development of human source management policies.¹⁷⁶

General review processes within Victoria Police are in place for annual or biannual reviews of most policies, though this does not apply to human source management policies.¹⁷⁷ Ms Steendam told the Commission that Victoria Police would be open to incorporating a formal review schedule.¹⁷⁸

Victoria Police advised the Commission that the May 2020 changes to the Human Source Policy were informed by:

• information obtained from an international study tour undertaken by Mr Paterson and Superintendent Scott Mahony in February 2019 after the commencement of the Commission’s inquiry
• information and consultation with the Australasian Human Source Working Group
• feedback provided by the Victorian Government Solicitor’s Office
• court matters where human source issues have been raised
• learnings from issues explored in the Commission’s hearings
• feedback from human source handlers, controllers, Officers in Charge, LSRs, HSMU officers, officers from the dedicated unit that manages high-risk human sources, and internal subject matter experts
• advice provided by counsel appearing for Victoria Police.¹⁷⁹

In 2015, Victoria Police amended its human source management training to refer to the Human Source Policy provisions that relate to legal obligations of confidentiality and professional privilege.¹⁸⁰ The following content was included in the training module:

Professional privilege: Are they a doctor, parliamentarian, court official, journalist, priest or someone else who may have professional obligations regarding confidentiality? (Refer [to the Human Source Policy])

Where any of these circumstances exist, contact HSMU at the earliest opportunity (preferably before meeting the Source) to discuss the associated risks.¹⁸¹

From the information available to the Commission, this training did not cover what confidentiality and privilege mean, or why obtaining confidential and privileged information from a human source is a risk.

During the course of this inquiry, in November 2019 and March 2020, Victoria Police arranged for the Victorian Government Solicitor’s Office to provide training on privilege and Victoria Police’s disclosure obligations to officers from the HSMU, officers from dedicated source units and other officers ‘actively involved in human source management’.¹⁸²

Ms Steendam informed the Commission that all officers involved in human source management ‘at the ground level’ will have access to training about the changes incorporated in the Human Source Policy and will be expected to understand the revised policy requirements.¹⁸³ Handlers who have not undertaken updated training will not be able to register a human source.¹⁸⁴

In addition, the Human Source Policy now includes examples of hypothetical scenarios to assist officers in understanding their responsibilities under the new framework.

Observations drawn from the Commission’s focus groups with Victoria Police officers relating to the organisation’s policy development and change management processes are outlined in Box 11.6.

Conclusions and recommendations

Including the Commission’s inquiry, Victoria Police’s human source management practices have been subject to over 20 reviews in as many years. The recurrence of similar findings and recommendations points to the persistence of common risks and issues in these practices.

The Commission acknowledges that during the Kellam inquiry and up until the introduction of the most recent version of the Human Source Policy in May 2020, Victoria Police made a number of significant changes to its human source management policies and processes to address identified risks and issues. A summary of the key changes is provided in Figure 11.3.

Figure 11.3: Key changes to the Human Source Policy arising from the Kellam Report ¹⁸⁵

Some recommendations were implemented consistently with the apparent intention of the Comrie Review and Kellam Report, while others were not implemented in full until recently. In some cases, Victoria Police directly transposed text from recommendations into the Human Source Policy and did not include contextual information or guidance to achieve effective implementation of the new requirements.

In some cases, it took Victoria Police several years to introduce policy changes to address the Kellam Report recommendations. Some of these recommendations were first made in other reviews completed years before the completion of the Kellam Report.

In the following sections, the Commission addresses these issues in more detail.

Adequacy of policy and system reforms

Evidence before the Commission indicated that Victoria Police implemented a number of the Kellam Report recommendations in a way that adequately addressed their scope and intent and contributed to a more robust human source management framework.

These include the recommendations related to the day-to-day management of human sources (Recommendations 4–10), and the dissemination of the Kellam Report and amended Victoria Police policies to relevant parties (Recommendations 11–16).

In contrast, recommendations to incorporate safeguards relating to confidential and privileged information (Recommendation 1) and risk assessment practices (Recommendations 2 and 3) appear to have been implemented less effectively.

Importantly, it was the absence of safeguards related to the use of confidential and privileged information and inadequate risk assessment processes that gave rise to the inappropriate use of Ms Gobbo as a human source and the establishment of the Commission. It is therefore a concern that Victoria Police’s Human Source Policy did not, until very recently, fully address these issues identified by the Comrie Review and the Kellam Report.

Supporting an understanding of confidentiality and privilege

Between 2014 and 2020, Victoria Police made a number of policy and system changes in response to the Comrie Review and Kellam Report recommendations that called for special consideration to be applied to obtaining, using and managing information that may be subject to confidentiality or privilege.¹⁸⁷ As outlined earlier in this chapter, these changes included:

• requiring officers to be mindful that some human sources might be bound by professional obligations and to obtain advice from the HSMU about how to handle confidential or privileged information¹⁸⁸
• establishing an Ethics Committee to consider the registration of human sources in ‘Kellam Occupations’ and involving complex ethical or legal issues, which appeared to be consistent with Recommendation 1(b) of the Kellam Report¹⁸⁹
• strengthening its system capability to identify sources with legal obligations of confidentiality or privilege.

While these steps improved Victoria Police’s capacity to identify issues relating to legal obligations of confidentiality or privilege, Victoria Police did not introduce changes that fully addressed Recommendation 1(a) of the Kellam Report until May 2020. That aspect of the recommendation was intended to create safeguards for the use of potentially confidential and privileged information obtained from all human sources, not only those in one of the Kellam Occupations.

Victoria Police acknowledged to the Commission that the initial amendments to the Human Source Policy in response to the Kellam Report did not effectively capture the full set of circumstances in which officers might receive confidential or privileged information, as Recommendation 1(a) intended. It explained that these policy amendments targeted what Victoria Police considered to be the occupations ‘most likely to potentially provide

information that may be subject to legal obligations of confidentiality and privilege’ and suggested that the current Human Source Policy contains more stringent requirements than those that exist in other jurisdictions.¹⁹⁰

The Commission also considers that the policy changes introduced in response to the Comrie Review and the Kellam Report were not accompanied by sufficient supporting guidance and training about the nature of confidential and privileged information, the difference between the two, how to identify such information, and the risks associated with obtaining and using such information from human sources. This appears to have contributed to uncertainty among officers responsible for implementing the Human Source Policy and handling human sources, which was evident in the responses of some officers who participated in the Commission’s focus groups. Victoria Police advised the Commission that training related to confidential and privileged information was provided to officers involved in human source management in November 2019 and March 2020.¹⁹¹

Additionally, the Commission considers that Victoria Police’s removal of a clear instruction from the Human Source Policy for officers not to actively seek information from human sources involving legal obligations of confidentiality or privilege—in line with Recommendation 1(d) of the Kellam Report—creates a gap in the current policy. This is discussed further in Chapter 12.

Finally, while the Ethics Committee was established in 2014 to make decisions about human sources involving complex ethical and legal issues, until 20 August 2019, it had not considered any human source matters involving issues of confidentiality or privilege. Based on the evidence available to the Commission through its audit of selected human source files, it appears that in practice, officers in the handling team or the CSR made the decision about whether an issue of confidentiality or privilege existed. Consequently, there was no referral to the Ethics Committee, no legal advice was sought to inform the decisions, and there were inconsistencies in decision making about the registration and use of these human sources.

The Commission notes that the current Human Source Policy aims to address the Kellam Report recommendations more fully and better protect against the inappropriate use of confidential or privileged information from human sources. Nonetheless, the Commission considers that further policy, procedural, system and structural reforms are necessary to manage this risk. Chapter 12 examines these issues in more detail.

Further strengthening risk assessments

Following the Kellam Report, Victoria Police took prompt action to revise its risk assessment processes. It introduced a new Human Source Risk Assessment template and amended its Human Source Policy to require risk assessments to state the purpose of engagement with a human source and for this to be regularly reviewed. Yet operational demands, conflicting priorities and overly cumbersome risk assessment processes appear to have contributed to inconsistent practices and areas of non-compliance. The Commission recognises, however, that its audit of human source files indicated that routine monitoring by the HSMU sometimes enabled instances of non-compliance to be remedied.

The Commission’s conclusions associated with aspects of the Kellam Report recommendations relating to risk assessments discussed below, informed its recommendations about Victoria Police’s current risk assessment practices, contained in Chapter 12.

Positive obligation: a duty to protect the community

The concept of ‘positive obligation’, as envisaged by the Comrie Review and Kellam Report, was not confined to human sources subject to legal obligations of confidentiality or privilege. The recommendation related to circumstances in which Victoria Police considers it has a duty to use information from any human source to protect the broader community.¹⁹² This recommendation is important, because it sought to guard against situations where officers disregard or understate the ethical and legal risks of using a human source due to the perceived value of the source’s information. It emphasised the need to reflect carefully on necessity and proportionality in the use of all human sources where Victoria Police considers it has a positive obligation to use the information.

Prior to May 2018, there was no definition or explanation of positive obligation within the Human Source Policy. This was despite the inclusion of the term in the Ethics Committee terms of reference in 2015. When this was introduced into policy, it was conflated with legal obligations of confidentiality or privilege and defined by reference to circumstances ‘where information is provided by a source who is bound by legislation or rules of their profession (that is, legal/professional privilege, medical Hippocratic oath)’.¹⁹³

These policy provisions created confusion among police officers responsible for engaging with human sources and did not appropriately contextualise the circumstances in which Victoria Police is under a duty to act on information to protect the community. Although Victoria Police has now removed reference to the term, greater support should be provided to officers to assist them in navigating the complex balancing exercise of assessing necessity and proportionality in the use of human sources.

Improved human rights guidance

Aspects of the Kellam Report recommendations dealing with necessity and proportionality were based on the Comrie Review. The Comrie Review highlighted the importance of reflecting upon these concepts, which exist within the United Kingdom’s rights-based approach to human source management. Victoria Police’s existing obligations under the Charter similarly require that a human right may only be subject to reasonable limits.¹⁹⁴

Victoria Police’s Human Source Policy did not set out the requirement for officers to consider human rights or to assess necessity and proportionality in the use of human sources until May 2020, about 18 months into the Commission’s inquiry and 14 years after the introduction of the Charter. Although Victoria Police’s Human Rights Standards were in place, these were not referenced in any versions of the Human Source Policy.

Victoria Police explained to the Commission that the Human Source Policy is to be read within the broader context of its Victoria Police Manual and that while past versions of the Human Source Policy did not expressly refer to human rights requirements, officers ‘were still aware of and required to act in accordance with’ the Human Rights Standards.¹⁹⁵

Victoria Police also suggested that, because each part of the Victoria Police Manual, including the Human Source Policy, ‘is developed in consideration of human rights implications, it was not necessary for each iteration of the [Human Source Policy] to have referred to human rights’.¹⁹⁶ Victoria Police also noted that ‘while all members involved in human source management make decisions in fulfilling their duties that may affect human rights, the most impactful decisions are reserved to senior experienced members and are subject to review by the [Ethics Committee] and Deputy Commissioner, Specialist Operations’.¹⁹⁷

The Commission disagrees with Victoria Police on these matters. The fact that human rights are considered as part of Victoria Police’s development of a policy does not negate the need to inform and guide officers about their obligations to consider and act compatibly with the Charter in their management of human sources. Further, while more senior officers may well make the most ‘impactful decisions’, handlers and other officers involved in the day-to-day management of a human source also make decisions that potentially affect and limit human rights, and require guidance to do so in a lawful and considered way. An awareness of and respect for human rights should be embedded at every level throughout the organisation.

The Commission notes that the Human Source Policy introduced in May 2020 now contains a section that deals with human rights obligations. While this is a positive development, the policy and associated training could be more instructive about what necessity and proportionality mean in practice and in the context of the Charter. This is discussed further in Chapter 12.

Reviewing risk assessments

The recommendations that required LSRs to review, endorse and amend risk assessments as appropriate were adequately reflected in amendments to the Human Source Policy in 2014.

Despite these early policy amendments, evidence before the Commission indicates that LSRs have not practised supervision and review of risk assessments consistently. The Commission’s audit and focus groups with Victoria Police officers suggested that although LSRs review risk assessments thoroughly on occasion, this is not a common practice. It appears that operational demands, competing priorities and limited training have each contributed to the lack of consistent and robust oversight and scrutiny of risk assessments. The adequacy of supervision and management more broadly is discussed in Chapter 12.

Timeliness of implementation

This chapter has focused on Victoria Police’s implementation of the Kellam Report recommendations. Yet many of these recommendations were originally raised in reviews conducted many years prior. The Kellam Report, completed in February 2015, repeated recommendations made by the Comrie Review in 2012,¹⁹⁸ which had endorsed the findings of a Victoria Police Corporate Management Review Division Audit finalised in 2010.¹⁹⁹

The Commission is satisfied that most of the Kellam Report recommendations were implemented within a reasonable timeframe; that is, within one year following the completion of the report. There were, however, significant delays in the implementation of some recommendations.

Contrary to Victoria Police’s advice to IBAC in 2018, the Commission considers that Recommendations 1 and 3 of the Kellam Report were not implemented at this time. As outlined above, these recommendations related to safeguards regarding the use of confidential or privileged information from human sources and risk assessment practices, and were, arguably, the most important of the Kellam Report recommendations. The recommendations were also made in the Comrie Review.

The Commission considers that Victoria Police did not fully address these recommendations until it issued the most recent version of the Human Source Policy in May 2020—eight years after the Comrie Review was completed; and 18 months after the Commission’s inquiry commenced. In addition, some aspects of these recommendations are not yet adequately embedded in officers’ operational practice.

In the Commission’s view, this delay is unacceptable. Addressing these recommendations in a timely way was critical, given the significance of the issues and risks identified by those reviews relating to the use of Ms Gobbo as a human source, and the need to prevent similar events from occurring in future.

Victoria Police acknowledged that it could have implemented some of the Kellam Report recommendations faster but noted that it had implemented ‘the vast majority of recommendations’ within a year and that all recommendations have since been incorporated into its human source management framework.²⁰⁰ Victoria Police also emphasised that there was no intention to provide inaccurate information to IBAC in 2015 and 2018 when it reported on the measures adopted to address the Kellam Report.²⁰¹

While there is no evidence before the Commission to suggest that Victoria Police deliberately misled IBAC, the fact remains that some important Kellam Report recommendations were not fully implemented at this time.

It will be important for Victoria Police to implement the Commission’s recommended changes to Human Source Policy in a timely way to mitigate the risks that remain in its current human source management framework.

Recommendations must also be implemented thoughtfully and with due consideration to the organisational and system supports needed to effect meaningful change. This is discussed further below.

Improving policy development and change management processes

Throughout the Commission’s inquiry, Victoria Police continued to make changes to the Human Source Policy. In a submission in response to Counsel Assisting submissions, Victoria Police indicated these policy changes reflected the evolution of human source management over time and its commitment to best practice, rather than a deficient response to the Kellam Report recommendations.²⁰²

Several changes incorporated in the Human Source Policy in May 2020 better reflected the intent of the Kellam Report recommendations and usefully clarified aspects of the policy. As noted in Chapter 12, many of these changes also appeared to align the Human Source Policy more closely to principles underpinning the United Kingdom’s human source management framework. These principles have been in place in the United Kingdom since 2001, some 14 years before the completion of the Kellam Report, and were considered by the Comrie Review, completed in 2012.

As noted above, the changes were not introduced until almost 18 months into the Commission’s inquiry, after Victoria Police received advice from its counsel. The changes also addressed several risks and issues identified by the Commission during the inquiry. As such, the Commission does not agree with Victoria Police’s view that its continual changes to the Human Source Policy demonstrate only its commitment to best practice, and not any deficiency in its earlier response to the Kellam Report recommendations. The changes seemed reactive rather than proactive.

An agency taking steps to improve its policies during an inquiry is not in and of itself worthy of criticism. Indeed, an agency that did not take some steps to promptly remedy identified deficiencies and strengthen its framework might be subject to criticism. Nonetheless, Victoria Police’s most recent updates to the Human Source Policy during the Commission’s inquiry related principally to changes that should have been implemented earlier and more comprehensively, in response to the Comrie Review and Kellam Report.

The Commission’s inquiry indicated that Victoria Police sought legal advice in 2015 associated with changes to its Human Source Policy. It appears that aspects of this advice were not incorporated into the policy, predominantly in relation to safeguards associated with identifying issues relating to confidentiality or privilege, consistent with Recommendation 1 of the Kellam Report and Recommendation 3 of the Comrie Review.

The Commission’s focus groups indicated that officers responsible for human source management were often not consulted to provide operational input into proposed policy changes. Consultation with stakeholders and staff, including those expected to apply and adhere to new requirements, is an important way that agencies can clarify intended impacts, obtain helpful operational feedback and guard against unintended consequences.

In addition, as outlined above, the policy changes implemented between 2014 and 2018 were not accompanied by adequate communication, guidance and training to officers responsible for human source management. This likely contributed to the uncertainty that exists among some officers about critical policy requirements and safeguards relating to the use of confidential or privileged information from human sources.

In a submission to the Commission, Victoria Police agreed that, as a general rule, broader input from and communication with officers can lead to policy improvements, but noted that, due to the specialised nature of human source management and the highly confidential nature of the Kellam Report, its consultation with officers on changes to the Human Source Policy was appropriately limited.²⁰³

The Commission considers that, notwithstanding the confidentiality of the Kellam Report, there would have been no impediment to Victoria Police consulting with and seeking input from relevant operational officers on proposed changes to the Human Source Policy before finalising and issuing that policy. Victoria Police’s implementation of the Kellam Report recommendations could have been accompanied by a more effective consultation and change management process aimed at ensuring that the policy changes were operationally feasible and that officers understood the nature, scope and intent of those changes. The Commission notes that Victoria Police undertook a process of consultation with officers when developing the Human Source Policy in 2020 and has indicated that all officers who manage human sources will receive training related to the new policy. This is a positive, if overdue step.

The Commission also considers that Victoria Police could have taken more effective action to monitor and evaluate the effectiveness of policy changes, including by engaging with officers responsible for human source management regarding their understanding of revised expectations and changes to policy. Ongoing monitoring and review of policy changes is necessary to ensure that policy requirements are clear, understood by officers, and applied effectively and consistently across the organisation. This is also important to enable continuous improvement and ensure that policies respond to emerging issues and risks.

The Commission considers that this recommendation should be implemented within three months, so that the new processes can support and guide Victoria Police’s development and implementation of the human source management reforms the Commission recommends in Chapter 12. This also aligns with the timeframe the Commission has recommended in that chapter for Victoria Police to establish a strategic governance committee to oversee this reform program.

Endnotes

_{1 Mr Kellam led the inquiry on behalf of IBAC after the then Commissioner of IBAC, Mr Stephen O’Bryan, QC, declared himself unable to act due to a perceived conflict of interest: Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 1 [1].}

_{2 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 4 [9].}

_{3 Transcript of Deputy Commissioner Wendy Steendam, 7 May 2020, 14897–8; Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 17–18 [5.1], 19–20 [5.3].}

_{4 The current Human Source Policy was finalised in April 2020 but came into effect in May 2020: Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020.}

_{5 Exhibit RC0275b Statement of Officer ‘Sandy White’, undated, 14 [52]–[54]; Consultation with South Australia Police, 6 September 2019; Consultation with Sir Jonathan (Jon) Murphy, 11 October 2019.}

_{6 Consultation with South Australia Police, 6 September 2019; Consultation with Queensland Police, 8 October 2019.}

_{7 Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, 27 [4.14]–[4.17].}

_{8 Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, Annexure 34, 1 [3]–[4]; Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, Annexure 36, 1 [4].}

_{9 Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, 45 [5.9], 46 [5.10].}

_{10 Exhibit RC0276 Review & Develop Best Practice Human Source Management Policy 2004, 16 April 2004, 20.}

_{11 Exhibit RC0276 Review & Develop Best Practice Human Source Management Policy 2004, 16 April 2004, 20–1.}

_{12 Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, 28 [4.22].}

_{13 Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, 46 [5.10].}

_{14 Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, 12 [3.44].}

_{15 Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, Annexure 37, 5 [7.1]; Exhibit RC0276 Review & Develop Best Practice Human Source Management Policy 2004, 16 April 2004, 20.}

_{16 Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, Annexure 37, 5 [7.2].}

_{17 See, eg, Exhibit RC0108 Victoria Police, Review of the Victoria Police Drug Squad (Report, November 2001), 176–8.}

_{18 Exhibit RC0108 Victoria Police, Review of the Victoria Police Drug Squad (Report, November 2001) 22 [3.5]; Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, Annexure 51, 16 [10]; Office of Police Integrity, Past Patterns—Future Directions: Victoria Police and the Problem of Corruption and Serious Misconduct (Report, October 2007); Office of Police Integrity, Annual Report—Financial Year Ending 30 June 2008 (Report, 2008).}

_{19 Office of Police Integrity, Leak of a Sensitive Victoria Police Information Report (Report, February 2005); Office of Police Integrity, Investigation into the Publication of One Down, One Missing (Report, September 2005).}

_{20 See, eg, Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, Annexure 50, 114 [13.12]; Office of Police Integrity, Investigation into the Publication of One Down, One Missing (Report, September 2005); Office of Police Integrity, Annual Report—Financial Year Ending 30 June 2006 (Report, 2006) 52; Office of Police Integrity, Report on Investigation into Operation Clarendon (Report, 2008), 17.}

_{21 See, eg, Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, Annexure 51, 16–17; Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, Annexure 57, 6–11.}

_{22 Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, Annexure 57, 9–10.}

_{23 AB & EF v CD [2017] VSC 350 (Ginnane J).}

_{24 Based on Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, Annexure 50; Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, Annexure 51, 16; Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, Annexure 53, ii; Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, Annexure 56, 2; Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, Annexure 60; Exhibit RC0276 Review & Develop Best Practice Human Source Management Policy, April 2004, 13–15; Exhibit RC0359 Victoria Police, Covert Services Review (Intelligence & Covert Support Command) (Report, December 2012) 10–11; Office of Police Integrity, Leak of a Sensitive Victoria Police Information Report (Report, February 2005) 8 [26]; Office of Police Integrity, Investigation into the Publication of One Down, One Missing (Report, September 2005) 15; Ombudsman Victoria, Ceja Task Force Drug Related Corruption: Second Interim Report of Ombudsman Victoria (Report, June 2004); Office of Police Integrity, Annual Report—Financial Year Ending 30 June 2008 (Report, 2008) 18; Office of Police Integrity, Report on Investigation into Operation Clarendon (Report, 2008) 23; Neil Comrie, Victoria Police Human Source 3838: A Case Review (Report, 30 July 2012).}

_{25 Neil Comrie, Victoria Police Human Source 3838: A Case Review (Report, 30 July 2012).}

_{26 Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, 47 [5.17].}

_{27 Exhibit RC1407b Statement of Superintendent Stephen Gleeson, 6 November 2019, 2 [9].}

_{28 Neil Comrie, Victoria Police Human Source 3838: A Case Review (Report, 30 July 2012) 26, 28, 42, 45, 47.}

_{29 Neil Comrie, Victoria Police Human Source 3838: A Case Review (Report, 30 July 2012) 43.}

_{30 Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, Annexure 57.}

_{31 The notification was made pursuant to section 57(2) of the Independent Broad-based Anti-corruption Commission Act 2011 (Vic). The Act requires the Chief Commissioner of Victoria Police to notify IBAC of any complaint received by the Chief Commissioner about corrupt conduct or police personnel misconduct by a Victoria Police employee: Exhibit RC1711 Letter from Kenneth (Ken) Lay to the Independent Broad-based Anti-corruption Commission, 10 April 2014.}

_{32 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 1 [1]; Anthony Dowsley, ‘Underworld Lawyer a Secret Police Informer’, Herald Sun (Melbourne, 31 March 2014).}

_{33 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 1 [4].}

_{34 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 82 [5(i)].}

_{35 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 83 [5(vi)].}

_{36 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 13 [9].}

_{37 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 13 [9].}

_{38 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 61 [11].}

_{39 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 57 [2].}

_{40 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 58 [2].}

_{41 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 80 [1].}

_{42 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 80–1 [1].}

_{43 Based on Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, 49 [5.28]; Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, Annexure 44, 10 [1.19]; Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, Annexure 82; Exhibit RC1950 Victoria Police Manual—Human Sources, 9 June 2015; Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, Annexure 47, 5 [1.19]; Exhibit RC1530b Victoria Police Manual—Human Sources, 8 May 2018; Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020; Exhibit RC1953 Letter from Timothy Cartwright to the Independent Broad-based Anti-corruption Commission, 26 June 2015; Exhibit RC1949 Letter from solicitors for Victoria Police to Solicitors Assisting the Commission, 26 June 2020 (Annexure B), 3; Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015); Transcript of Deputy Commissioner Wendy Steendam, 7 May 2020, 14897–8; Victoria Police, ‘Victoria Police Manual—Human Sources (Draft)’, 28 February 2020, produced by Victoria Police in response to a Commission Notice to Produce; Victoria Police, ‘Deliberations of Victoria Police’s Human Source Ethics Committee as at 15 June 2020’, produced by Victoria Police in response to a Commission Notice to Produce.}

_{44 The Human Source Policy 2018: Exhibit RC1530b Victoria Police Manual—Human Sources, 8 May 2018.}

_{45 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020.}

_{46 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 86–7 (Recommendation 1).}

_{47 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 87–8 (Recommendations 2–3).}

_{48 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 88–90 (Recommendations 4–10).}

_{49 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 90–1 (Recommendations 11–16).}

_{50 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 86–7 (Recommendation 1).}

_{51 Neil Comrie, Victoria Police Human Source 3838: A Case Review (Report, 30 July 2012) 20 (Recommendation 3).}

_{52 Email from Neil Comrie to the Commission, 13 November 2019.}

_{53 Email from Neil Comrie to the Commission, 13 November 2019.}

_{54 Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, Annexure 44, 12 [2.2], 15–16 [4.6]; Exhibit RC1953 Letter from Timothy Cartwright to the Independent Broad-based Anti-corruption Commission, 26 June 2015. The amendments to the Human Source Policy 2014 referred interchangeably to ‘occupational’ and ‘professional’ obligations of confidentiality or privilege.}

_{55 Exhibit RC1530b Victoria Police Manual—Human Sources, 8 May 2018, 16 [4.6].}

_{56 Exhibit RC1530b Victoria Police Manual—Human Sources, 8 May 2018, 17 [4.6].}

_{57 Exhibit RC1530b Victoria Police Manual—Human Sources, 8 May 2018, 9 [1.20]. The Ethics Committee was then referred to as the ‘Human Source Management Ethics Committee’ and was later renamed to the ‘Human Source Ethics Committee’. This Committee is referred to as the ‘Ethics Committee’ throughout this chapter.}

_{58 Exhibit RC1530b Victoria Police Manual—Human Sources, 8 May 2018, 11–12 [2.3].}

_{59 Exhibit RC1530b Victoria Police Manual—Human Sources, 8 May 2018, 9 [1.2].}

_{60 Exhibit RC1952 Statement of Assistant Commissioner Neil Paterson, 5 March 2020, 3 [17].}

_{61 Exhibit RC1952 Statement of Assistant Commissioner Neil Paterson, 5 March 2020, 13 [98].}

_{62 Exhibit RC1952 Statement of Assistant Commissioner Neil Paterson, 5 March 2020, 13 [96].}

_{63 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 62 [286].}

_{64 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 62 [286].}

_{65 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 62 [286].}

_{66 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 62 [286]; Letter from solicitors for Victoria Police to Solicitors Assisting the Commission, 17 August 2020, 4–5.}

_{67 Exhibit RC1952 Statement of Assistant Commissioner Neil Paterson, 5 March 2020, 13 [98].}

_{68 Letter from solicitors for Victoria Police to Solicitors Assisting the Commission, 17 August 2020, 2, 4.}

_{69 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 19 [5.3], 20 [8.5].}

_{70 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 19 [5.3], 8.5 [30].}

_{71 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 55 [253].}

_{72 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 73 [317].}

_{73 Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, Annexure 48, 4 [1.7], 5 [1.9].}

_{74 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 9 [3].}

_{75 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 13 [10].}

_{76 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 13 [10].}

_{77 Neil Comrie, Victoria Police Human Source 3838: A Case Review (Report, 30 July 2012) 29; Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 13–14, 48.}

_{78 Neil Comrie, Victoria Police Human Source 3838: A Case Review (Report, 30 July 2012) 33 (Recommendation 4).}

_{79 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 87 (Recommendation 2).}

_{80 Recommendation 3(a) refers to changes in the scope or purpose of engaging a human source: Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 87–8 (Recommendation 3); Neil Comrie, Victoria Police Human Source 3838: A Case Review (Report, 30 July 2012) 34 (Recommendation 5).}

_{81 Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, Annexure 1, 3–5; Victoria Police, ‘Human Source Risk Assessment’, 1 May 2015, produced by Victoria Police in response to a Commission Notice to Produce.}

_{82 Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, Annexure 44, 15–16 [4.6]; Exhibit RC1530b Victoria Police Manual—Human Sources, 8 May 2018, 17 [4.6].}

_{83 Exhibit RC1530b Victoria Police Manual—Human Sources, 8 May 2018,15 [4.3].}

_{84 Exhibit RC1530b Victoria Police Manual—Human Sources, 8 May 2018, 9 [1.20].}

_{85 Exhibit RC1530b Victoria Police Manual—Human Sources, 8 May 2018, 16 [4.5].}

_{86 Exhibit RC1530b Victoria Police Manual—Human Sources, 8 May 2018, 16–17 [4.5]–[4.6].}

_{87 Neil Comrie, Victoria Police Human Source 3838: A Case Review (Report, 30 July 2012) 34 (Recommendation 5(d)); Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 88 (Recommendation 3(d)).}

_{88 See, eg, Exhibit RC1952 Statement of Assistant Commissioner Neil Paterson, 5 March 2020, 2 [14]–[15], 5–6 [31], 6 [45].}

_{89 Neil Comrie, Victoria Police Human Source 3838: A Case Review (Report, 30 July 2012) 23.}

_{90 Neil Comrie, Victoria Police Human Source 3838: A Case Review (Report, 30 July 2012) 26.}

_{91 Neil Comrie, Victoria Police Human Source 3838: A Case Review (Report, 30 July 2012) 23.}

_{92 Neil Comrie, Victoria Police Human Source 3838: A Case Review (Report, 30 July 2012) 23.}

_{93 Neil Comrie, Victoria Police Human Source 3838: A Case Review (Report, 30 July 2012) 34 (Recommendation 5(d)); Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 88 (Recommendation 3(d)).}

_{94 Exhibit RC1953 Letter from Timothy Cartwright to Independent Broad-based Anti-corruption Commission, 26 June 2015, 5.}

_{95 Exhibit RC1953 Letter from Timothy Cartwright to Independent Broad-based Anti-corruption Commission, 26 June 2015, 5; Victoria Police, ‘Human Source Management Ethics Committee Terms of Reference’, undated, 1, produced by Victoria Police in response to a Commission Notice to Produce.}

_{96 Exhibit RC1530b Victoria Police Manual—Human Sources, 8 May 2018, 9 [1.20].}

_{97 Exhibit RC1530b Victoria Police Manual—Human Sources, 8 May 2018, 9 [1.20].}

_{98 Exhibit RC1530b Victoria Police Manual—Human Sources, 8 May 2018, 9 [1.20].}

_{99 Exhibit RC1952 Statement of Assistant Commissioner Neil Paterson, 5 March 2020, 2 [11].}

_{100 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 32 [8.9].}

_{101 Neil Comrie, Victoria Police Human Source 3838: A Case Review (Report, 30 July 2012) 23.}

_{102 As provided for in Exhibit RC1541 Regulation of Investigatory Powers Act 2000 (UK) and the Home Office (UK), Covert Human Intelligence Sources—Code of Practice (2010); Email from Neil Comrie to the Commission, 13 November 2019.}

_{103 Charter of Human Rights and Responsibilities Act 2006 (Vic) s 7(2).}

_{104 Exhibit RC1530b Victoria Police Manual—Human Sources, 8 May 2018, 9 [1.20].}

_{105 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 41 [191].}

_{106 Victoria Police, ‘Victoria Police Manual—Policy Rules—Human rights equity and diversity standards’, 31 August 2015, 3, produced by Victoria Police in response to a Commission Notice to Produce.}

_{107 Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, Annexure 44, 13 [3.2], 16 [5.3], 29 [16].}

_{108 Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, Annexure 47, 5 [1.19], 13 [4.4].}

_{109 Exhibit RC1532b Victoria Police, Human Source Strategy 2018–2022 (v 7 draft): A better way to manage risk, undated, 2–3, 6.}

_{110 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 5 [1.3].}

_{111 Victoria Police, ‘Human Source Ethics Committee Terms of Reference’, 12 April 2020, 6, produced by Victoria Police in response to a Commission Notice to Produce.}

_{112 Email from Neil Paterson to Wendy Steendam, 30 October 2019, 1, produced by Victoria Police in response to a Commission Notice to Produce.}

_{113 Exhibit RC1949 Letter from solicitors for Victoria Police to Solicitors Assisting the Commission (Annexure A), 26 June 2020, 10 [32].}

_{114 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 13 [9].}

_{115 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 88 (Recommendation 4).}

_{116 Neil Comrie, Victoria Police Human Source 3838: A Case Review (Report, 30 July 2012) 39 (Recommendation 9).}

_{117 Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, Annexure 1, 7.}

_{118 Exhibit RC1530b Victoria Police Manual—Human Sources, 8 May 2018, 4 [1.7], 7 [1.14], 8 [1.17]; Exhibit RC1950 Victoria Police, ‘Victoria Police Manual—Human Sources’, 9 June 2015, [1.7].}

_{119 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 11 [1].}

_{120 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 53 [2].}

_{121 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 11 [2].}

_{122 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 88 (Recommendation 5).}

_{123 Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, Annexure 47, 14 [4.5]; Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, Annexure 1, 8.}

_{124 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 37 [5].}

_{125 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 15 [11], 29 [3].}

_{126 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 89 (Recommendation 6).}

_{127 Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, Annexure 1, 10; Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, 39 [4.77].}

_{128 Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, Annexure 1, 10; Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, 39 [4.77].}

_{129 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015), 28 [2].}

_{130 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 89 (Recommendation 7).}

_{131 Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, Annexure 1, 12; Neil Comrie, Victoria Police Human Source 3838: A Case Review (Report, 30 July 2012) 50 (Recommendation 21).}

_{132 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 89 (Recommendation 8).}

_{133 Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, Annexure 1, 13.}

_{134 Exhibit RC1530b Victoria Police Manual—Human Sources, 8 May 2018, 6 [1.11].}

_{135 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 33.}

_{136 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 33.}

_{137 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 89 (Recommendation 9).}

_{138 Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, Annexure 1, 13.}

_{139 Exhibit RC1530b Victoria Police Manual—Human Sources, 8 May 2018, 12 [2.5].}

_{140 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 59 [2].}

_{141 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 59 [2].}

_{142 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 89–90 (Recommendation 10). A similar recommendation was made by the Comrie Review: Neil Comrie, Victoria Police Human Source 3838: A Case Review (Report, 30 July 2012) 61 (Recommendation 27).}

_{143 Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, Annexure 1, 14.}

_{144 Exhibit RC1530b Victoria Police Manual—Human Sources, 8 May 2018, 10–12 [2.2]–[2.5].}

_{145 Exhibit RC1530b Victoria Police Manual—Human Sources, 8 May 2018, 11 [2.2].}

_{146 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 5–6 [1.4].}

_{147 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 90 (Recommendation 11).}

_{148 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 91 (Recommendation 15).}

_{149 Exhibit RC1953 Letter from Timothy Cartwright to Independent Broad-based Anti-corruption Commission, 26 June 2015, 1.}

_{150 Exhibit RC0010 Letter from Shane Patton to Independent Broad-based Anti-corruption Commission, 9 May 2018.}

_{151 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 90 (Recommendation 12).}

_{152 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 91 (Recommendations 13 and 14).}

_{153 Letter from Timothy Cartwright to John Champion, 13 February 2015, produced by Victoria Police in response to a Commission Notice to Produce.}

_{154 Email from Counsel Assisting Victoria Police to the Commission, 11 August 2020; Letter from Stephen O’Bryan to Timothy Cartwright, 6 February 2015, produced by Victoria Police in response to a Commission Notice to Produce.}

_{155 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 91.}

_{156 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 94 [403], 95 [409].}

_{157 Responsive submission, Victoria Police, 24 August 2020, 312, 325 [144.3].}

_{158 Responsive submission, Victoria Police, 24 August 2020, 325 [144.2]–[144.3].}

_{159 Jeffrey Hiatt and Timothy Creasy, Change Management: The People Side of Change (Prosci Learning Center Publications, 2015) 11.}

_{160 The Victorian Public Sector Commission was established in April 2014, replacing the State Services Authority: State Services Authority, Great Manager, Great Results: Development Framework for Victorian Public Sector Managers (Report, 2009) 23.}

_{161 State Services Authority, Organisational Change (Report, 2013) 62.}

_{162 State Services Authority, Great Manager, Great Results: Development Framework for Victorian Public Sector Managers (Report, 2009) 23.}

_{163 Victoria Police, Capability Plan 2016–2025: Capability Framework (Report, 8 August 2019) 4 [1.1].}

_{164 Victoria Police, Capability Plan 2016–2025: Capability Framework (Report, 9 August 2019) 38.}

_{165 These taskforces conducted Operation Loricated and Operation Bendigo.}

_{166 Victoria Police, ‘Human Source Management Ongoing Risk Management and Post Implementation Review Phase 1’ 2015, produced by Victoria Police in response to a Commission Notice to Produce.}

_{167 Victoria Police, ‘Human Source Management Ongoing Risk Management and Post Implementation Review, Phase 1’, 2015, 7, produced by Victoria Police in response to a Commission Notice to Produce.}

_{168 Victoria Police, ‘Human Source Management Ongoing Risk Management and Post Implementation Review, Phase 2’, 2015, 3–5, produced by Victoria Police in response to a Commission Notice to Produce.}

_{169 Victorian Government Solicitors Office, ‘Review of draft Victoria Police policy in response to IBAC report’, 22 April 2015, 2 [10], produced by Victoria Police in response to Commission Notice to Produce.}

_{170 Victorian Government Solicitors Office, ‘Review of draft Victoria Police policy in response to IBAC report’, 22 April 2015, 2 [9], produced by Victoria Police in response to a Commission Notice to Produce.}

_{171 Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, 38 [4.71]; Letter from solicitors for Victoria Police to Solicitors Assisting the Commission, 17 August 2020, 3.}

_{172 Transcript of Deputy Commissioner Wendy Steendam, 7 May 2020, 14863.}

_{173 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 2 [9].}

_{174 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 2 [9].}

_{175 Transcript of Deputy Commissioner Wendy Steendam, 7 May 2020, 14861.}

_{176 Exhibit RC1952 Statement of Assistant Commissioner Neil Paterson, 5 March 2020, 1 [6].}

_{177 Transcript of Deputy Commissioner Wendy Steendam, 7 May 2020, 14861.}

_{178 Transcript of Deputy Commissioner Wendy Steendam, 7 May 2020, 14861.}

_{179 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 3 [13]; Transcript of Deputy Commissioner Wendy Steendam, 7 May 2020, 14862, 14897–8.}

_{180 Victoria Police, ‘Presentation—Source Management (Module 2)’, 19 November 2015, produced by Victoria Police in response to a Commission Notice to Produce.}

_{181 Victoria Police, ‘Presentation—Source Management (Module 2)’, 19 November 2015, 6, produced by Victoria Police in response to a Commission Notice to Produce.}

_{182 Exhibit RC1949 Letter from solicitors for Victoria Police to Solicitors Assisting the Commission (Annexure A), 26 June 2020, 7 [21].}

_{183 Transcript of Deputy Commissioner Wendy Steendam, 7 May 2020, 14859.}

_{184 Transcript of Deputy Commissioner Wendy Steendam, 7 May 2020, 14859.}

_{185 Based on Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, Annexure 44, Annexure 47, Annexure 48; Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020.}

_{186 Transcript of Deputy Commissioner Wendy Steendam, 7 May 2020, 14897–8.}

_{187 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 86 (Recommendation 1(a)).}

_{188 Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, 36 [4.65], 38 [4.71], 41 [4.83]; Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, Annexure 44, 15–16 [4.6].}

_{189 Victoria Police, ‘Human Source Management Ethics Committee—Terms of Reference, Version 2’ 23 July 2015 produced by IBAC to the Commission.}

_{190 Responsive submission, Victoria Police, 20 September 2020, 8 [4.12].}

_{191 Exhibit RC1949 Letter from solicitors for Victoria Police to Solicitors Assisting the Commission (Annexure A), 26 June 2020, 7 [21].}

_{192 Neil Comrie,Victoria Police Human Source 3838: A Case Review (Report, 30 July 2012) 23.}

_{193 Exhibit RC1530b Victoria Police Manual—Human Sources, 8 May 2018, 9 [1.20].}

_{194 Charter of Human Rights and Responsibilities Act 2006 (Vic) s 7(2).}

_{195 Responsive submission, Victoria Police, 20 September 2020, 9 [4.19].}

_{196 Responsive submission, Victoria Police, 20 September 2020, 9 [4.19], [4.21].}

_{197 Responsive submission, Victoria Police, 20 September 2020, 10 [4.22].}

_{198 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 90 (Recommendation 15).}

_{199 Neil Comrie, Victoria Police Human Source 3838: A Case Review (Report, 30 July 2012) 7.}

_{200 Responsive submission, Victoria Police, 20 September 2020, 3 [1.2].}

_{201 Responsive submission, Victoria Police, 20 September 2020, 3–4 [2.2].}

_{202 Responsive submission, Victoria Police, 24 August 2020, 325 [144.2], [144.3].}

_{203 Responsive submission, Victoria Police, 20 September 2020, 4–5 [3.4]–[3.5].}

Introduction

Term of reference 3 required the Commission to inquire into and report on the current adequacy and effectiveness of Victoria Police’s processes for the recruitment, handling and management of human sources with legal obligations of confidentiality or privilege.

In this chapter, the Commission refers to human sources involving legal obligations of confidentiality or privilege, unless specifically talking about people who are themselves in an occupation or profession subject to such an obligation. This is because a human source who is not in an occupation subject to these obligations themselves might still have access to, and share with police, information that is confidential or privileged. As noted in Chapter 4, the Commission is primarily concerned with legal obligations of confidentiality and privilege arising from professional relationships, and by extension, confidential and privileged information derived from those relationships. In this chapter, the Commission uses the term ‘confidential or privileged information’ in this context.¹

Victoria Police’s use of Ms Nicola Gobbo as a human source occurred more than a decade ago and its policies have since undergone substantial changes, including changes made during the Commission’s inquiry. Victoria Police told the Commission that the failures relating to its use of Ms Gobbo as a human source could not occur today due to the safeguards in its current policy framework.²

In this chapter, the Commission considers whether Victoria Police’s current human source management framework is adequate and effective—that is, whether it sufficiently mitigates the risks that arise in the use of human sources, particularly the risk of obtaining and disseminating confidential or privileged information. Managing these risks is essential for the safety of human sources, the integrity of Victoria Police and the proper administration of justice. It is also integral to community trust and confidence in police and the criminal justice system, and the willingness of people to share information with Victoria Police that may in turn help to detect and prevent serious crimes.

A broad range of evidence informed this aspect of the Commission’s inquiry, including evidence from witnesses who appeared at the Commission’s hearings, the outcomes of the Commission’s audit of Victoria Police human source files, the views of Victoria Police officers who participated in the Commission’s focus groups, and information provided in response to notices to produce. The Commission also considered the human source management processes of other Australian and international law enforcement agencies, focusing particularly on the United Kingdom framework due to the safeguards it applies to confidential and privileged information, and similarities in the common law and statutory frameworks that operate in Victoria and the United Kingdom.

To conduct a thorough and meaningful inquiry into term of reference 3, the Commission considered the processes that apply to Victoria Police’s use and management of human sources generally, not just those that apply to the narrow class of human sources involving legal obligations of confidentiality or privilege. There are two key reasons for this.

First, while some of Victoria Police’s processes apply specifically to human sources involving legal obligations of confidentiality or privilege, others apply to all human sources. Consequently, it has been necessary to examine the broader framework to understand the full suite of processes that apply to the category of sources specified in term of reference 3.

Second, human sources involving legal obligations of confidentiality or privilege constitute a small proportion of sources used by Victoria Police, yet many risks and issues related to their registration and management also arise in the use of other human sources. The Commission sought to consider Victoria Police’s human source management framework in a holistic way—both to enable the development of meaningful and practical recommendations for reform, and to prevent unnecessarily fragmented or inconsistent approaches to different types of human sources.

Having examined the evidence, the Commission considers that Victoria Police’s current internal policy for the use of human sources is not sufficient to appropriately manage risk or guide officers in their decisions and actions, nor to assure the Victorian community and Government that events like those involving Ms Gobbo will not reoccur. While the Commission acknowledges that the use of human sources is a potent tool in Victoria Police’s investigative arsenal, it considers that continued self-regulation with an opaque set of rules, guidance and internal governance would be unsatisfactory.

With this in mind, the Commission recommends the introduction of legislation to regulate this high-risk area of policing more effectively; provide accountability and transparency to the public; and reinforce Victoria Police’s obligations to use human sources in a way that is necessary, proportionate and compatible with human rights.

The Commission also recommends that Victoria Police adopts a different organisational model, with dedicated handling teams, a more centralised decision-making process with clearer accountability, and a more rigorous registration process for human sources who are reasonably expected to have access to confidential or privileged information.

To support these changes and help officers fulfil their responsibilities under the new framework, the Commission recommends improvements in training and risk assessment processes, and regular auditing and monitoring of officers’ compliance with policy requirements.

The Commission appreciates that human sources provide Victoria Police with information that can be essential to the prevention and detection of crime. It also recognises the efforts Victoria Police has made to strengthen its policy framework, and the efforts its officers make every day to control and mitigate the many risks and challenges that arise in their use of human sources. The Commission’s recommendations aim to build on Victoria Police’s recent reforms and existing strengths, and support its officers to manage sources lawfully, ethically and even more effectively.

Current context and practice

This section summarises Victoria Police’s current framework for the use and management of human sources, including:

• the policy framework governing its use and management of human sources, including human sources involving legal obligations of confidentiality or privilege
• the key phases of the human source management framework
• the training Victoria Police officers receive in human source management
• the use and management of human sources in other Australian and international jurisdictions.

A summary of common human source management terms and processes, including the roles and responsibilities of officers involved in Victoria Police’s use and management of human sources, can be found in Volume I of this final report.

Policy framework

The Victoria Police Manual—Human Sources (Human Source Policy), issued by the Chief Commissioner of Victoria Police under section 60 of the Victoria Police Act 2013 (Vic), is the primary document governing Victoria Police’s use and management of human sources.

The Human Source Policy is not available publicly, on the basis that it contains material protected by public interest immunity.

The Human Source Policy defines a human source as a person who:

• volunteers or provides information on a confidential basis to Victoria Police to assist with criminal investigations; and
• has an expectation that their identity will remain confidential; and
• is registered as a human source.⁴

The objectives of the Human Source Policy are to:

• protect the integrity and safety of members [of Victoria Police] and human sources
• ensure the management of human sources is within legal and ethical boundaries
• protect Victoria Police’s reputation
• protect covert methodology
• support the use of human sources in investigations and information gathering
• assist Victoria Police to support community safety outcomes.⁵

The Human Source Policy sets out requirements for registering human sources, maintaining and recording contact with human sources, disseminating information, training officers who manage human sources, and internal decision-making, supervision, governance and auditing arrangements. The policy also sets out the roles, duties and responsibilities of the officers involved in human source management.

Victoria Police recognises that:

… well managed human sources can be the most affordable and efficient way to obtain information and subsequently evidence, but a poorly managed human source can be a significant risk for the organisation … For an organisation to reduce the risks presented by human sources, an effective policy and governance process framework is required that protects the organisation. If police do not adhere to policy then risk is amplified.⁶

Police officers who manage human sources must comply with the Human Source Policy. Non-compliance can lead to the suspension of human source files, management or disciplinary action against an officer, or—where unethical conduct is suspected—a referral to Victoria Police’s Professional Standards Command for investigation.⁷

In addition to internal policies and procedures, Victoria Police, like all public authorities in Victoria, is bound by the Charter of Human Rights and Responsibilities Act 2006 (Vic) (Charter).⁸ The purpose of the Charter is to protect and promote 20 essential civil and political human rights.⁹ It requires public authorities to act compatibly with human rights, and to consider human rights when developing policies, making laws, delivering services and making decisions.¹⁰

Under the Charter:

A human right may be subject under law only to such reasonable limits as can be demonstrably justified in a free and democratic society based on human dignity, equality and freedom, and taking into account all relevant factors including—

1. the nature of the right; and
2. the importance of the purpose of the limitation; and
3. the nature and extent of the limitation; and
4. the relationship between the limitation and its purpose; and
5. any less restrictive means reasonably available to achieve the purpose that the limitation seeks to achieve.¹¹

If a public authority acts ‘in a way that is incompatible with a human right’ without a reasonable basis, this will amount to a breach of the Charter.¹²

The Human Source Policy provides brief guidance for police officers about considering and applying the Charter. This is discussed further in the ‘Challenges and opportunities’ section of this chapter.

Use and management of human sources involving legal obligations of confidentiality or privilege

The Human Source Policy sets out specific requirements for human sources where legal obligations of confidentiality or privilege might arise, over and above the requirements that apply to other human sources.¹³ As noted in Chapter 4, this is because the provision of confidential or privileged information by a human source might result in a breach of another person’s right to and expectations of privacy, undermine the public interest in establishing and maintaining professional relationships built on trust, and damage the reputation and integrity of the profession and professionals involved.

Further, if the acquisition and/or use of the information is subsequently found to be illegal or improper, it can compromise criminal investigations, prosecutions and potentially convictions. This in turn can undermine the integrity of the criminal justice system.

The Human Source Policy lists types of human sources that may involve legal obligations of confidentiality or privilege and provides safeguards for their registration, use and management. As noted in Box 12.2, the policy does this by listing several occupations that may be subject to legal obligations of confidentiality or privilege, known as ‘Category 1’ human sources, and defines other classes of human sources who do not hold such obligations, but who may access confidential or privileged information because of their ‘connection to’ a Category 1 occupation.¹⁴ The Human Source Policy also prescribes further safeguards for situations where Victoria Police intends to obtain or use confidential or privileged information from a human source, regardless of whether or not that source is a Category 1 human source.

As outlined in Box 12.3 below, the number of human sources involving legal obligations of confidentiality or privilege is very small.

Use and management of other human sources involving higher risks

In addition to Category 1 human sources, Victoria Police also recognises that there are increased risks associated with the use of human sources:

• who are under the age of 18 years old (known as ‘Category 2’ human sources)
• who have a serious mental health condition or other serious medical health condition (known as ‘Category 3’ human sources)
• where the risks that they pose ‘would not normally permit registration’, but the information they wish to provide is of ‘extraordinarily high value’ (known as ‘Category 4’ human sources).¹⁹

Due to the risks of using Category 1–4 human sources, decisions to approach or register them must be made by the Victoria Police Human Source Ethics Committee (Ethics Committee).²⁰

The Ethics Committee is chaired by the Assistant Commissioner, Intelligence and Covert Support Command (ICSC). Its other members are the Assistant Commissioner, Professional Standards, the Executive Director, Legal Services and two other Assistant Commissioners or Commanders.

The key phases of Victoria Police’s human source management framework

The sections below outline the key phases of Victoria Police’s human source management framework, including the specific requirements that apply to human sources involving legal obligations of confidentiality or privilege (Category 1 human sources).

Phase 1: Risk assessment and registration

Before Victoria Police officers can disseminate information from a prospective human source, the person must first be registered as a human source.²¹ As outlined below, the registration process involves four key steps:

• submission of a registration application
• multi-levelled review and referral for registration
• authorisation of registration
• delivery of the Acknowledgement of Responsibilities (AOR) and activation of the registration.

Submission of a registration application

The handler initiates the registration process by creating a registration application in Interpose, Victoria Police’s intelligence and case management system.

Since October 2019, Interpose has had input requirements and alerts in place to prevent a person with legal obligations of confidentiality or privilege from being registered as a human source without the necessary stages of review and approval.²² For example, a registration application cannot proceed without the person’s occupation, or previous occupation, being entered into a mandatory field in Interpose.²³

Further, when creating a human source registration application in Interpose, a pop-up window appears asking the handler if the prospective source could be subject to a legal obligation of confidentiality or privilege (or whether the registration could breach such an obligation).²⁴ If the handler selects ‘yes’, they are instructed to discuss the proposed registration with the Human Source Management Unit (HSMU).²⁵

Since May 2020, the Human Source Policy has included hypothetical examples of circumstances where legal obligations of confidentiality or privilege could arise.

To support an application to register any human source (not just those involving legal obligations of confidentiality or privilege), the handler must submit the following documentation via Interpose:

• Initial Source Contact Report—a record of any information provided by the prospective (not yet registered) human source, including their personal information, and details of any contact with them.²⁶
• Mental Health Functioning Screen—a tool that identifies any potential indicators of serious mental health conditions, based on a prospective human source’s observable behaviour and self-reporting.²⁷
• AOR (in draft form)—an agreement setting out the parameters of the prospective human source’s relationship with Victoria Police.²⁸
• Initial Risk Assessment—an evaluation of the risks of using a prospective human source, which must identify the purpose of using the prospective human source.²⁹

The completion of the Initial Risk Assessment informs the decision about whether to register the person as a human source.³⁰ The assessment determines whether the prospective source is ‘low’, ‘medium’ or ‘high’ risk. It comprises 58 mandatory questions across the following categories:

• risk of compromising the safety or security of the source
• risk to the handling team
• risk to the information or investigation—that is, to the credibility of the information or the integrity of the investigation
• risk to the public
• risk to Victoria Police.³¹

There are no questions across these categories to prompt officers to consider risks to human rights or the administration of justice.

Once the risks are identified and assessed, mitigation strategies are applied to reduce or manage them. These strategies are employed on a case-by-case basis and could include appointing a more experienced handler or providing specific supports to the source. Some human sources may still be rated high-risk even after mitigation strategies are applied.

Only a specialised and dedicated human source team can handle and manage high-risk human sources.³² Under the Human Source Policy, Category 1 sources are always treated as high-risk.³³

Multi-levelled review and referral for registration

Five police officers or business units—the controller, Officer in Charge (OIC), Local Source Registrar (LSR), HSMU and Central Source Registrar (CSR), in that order, review the application prepared by the handler and the whole human source file in Interpose to:

• assess the appropriateness of registering the prospective human source
• review the Initial Risk Assessment and mitigation strategies
• review the draft AOR to ensure all responsibilities and accountabilities are outlined
• review the Mental Health Functioning Screen
• ensure all required documents are uploaded to Interpose within the stipulated timeframes
• make recommendations, including whether the registration should proceed.³⁴

Ordinarily, an application for registration is authorised by the HSMU or CSR.³⁵ The CSR authorises the registration of high-risk human sources, while the HSMU authorises the registration of low-risk and medium-risk human sources.³⁶

If the use of a prospective human source involves legal obligations of confidentiality or privilege (Category 1 human sources), the registration must be authorised at a higher level, by the Ethics Committee;³⁷ and, if there is a specific intention to use or obtain confidential or privileged information, by the Deputy Commissioner, Specialist Operations.³⁸ This is displayed in Figure 12.1 below.

Figure 12.1: Multi-levelled review of registration applications and final authorisation for the registration of human sources under the Human Source Policy ³⁹

Authorisation of registration: Ethics Committee decisions

Under the Human Source Policy, the Ethics Committee’s decision to authorise the registration of a Category 1–4 source must be formally documented and must also be informed by the Charter.⁴⁰

The Ethics Committee must consider the following factors in making its decisions:

• the seriousness of the offence to which the information relates, including the potential of serious injury or death to a person/s
• the [imminence] of the threat to which the information relates
• the likelihood of investigators obtaining the same information through other, less intrusive, investigatory or intelligence methods
• the potential to obtain the information from another human source who is not a category 1–4 human source
• the disclosure obligation if the [Ethics Committee] were to approve the use of a human source and information was obtained that was subject to a legal obligation of privilege or confidentiality
• the impact on the human rights of any individuals or the community if the information is utilised or not utilised
• legal advice obtained on the use of the potential human source and the use of any information [obtained] from the human source that is subject to a legal obligation of privilege or confidentiality
• any other legal or ethical considerations the [Ethics Committee] considers relevant

  …

• how the risk to the safety of the potential human source will be mitigated
• the potential for reputational damage to Victoria Police by entering [into] a human source relationship with the person
• any other specific conditions that should apply to the approach or registration.⁴¹

In addition, the Human Source Policy states that for Category 1 sources, the Ethics Committee:

… must obtain appropriate legal advice as to the legal implications of registering and using that human source and as to any conditions or safeguards that should be put in place in the event that the [Ethics Committee] provides approval to register the potential human source.⁴²

Before the Ethics Committee can authorise the registration of a human source, it must establish the specific purpose for using the human source and set a time period for their use. It can also set review periods, impose reporting obligations on the handling team, and set any other conditions for the use and management of the source, to be stipulated in the AOR.⁴³

Cases where the proposed registration or use of a human source is specifically intended to obtain or use confidential or privileged information must be authorised by the Deputy Commissioner, Specialist Operations, who is only permitted to do so ‘if there are exceptional and compelling circumstances’, meaning the action is:

• In the interests of national security; or
• For the purpose of preventing a serious threat to life or serious injury—and
• There is no other reasonable means of obtaining the information.⁴⁴

Figure 12.2 displays this registration process.

Figure 12.2: Current registration process for human sources involving legal obligations of confidentiality or privilege ⁴⁵

As noted above, the AOR sets the boundaries of the relationship between the human source and Victoria Police. It can include specific conditions to mitigate risks identified in the Initial Risk Assessment. For example, an AOR could include a condition that a human source who does not have a driver’s licence, and has prior convictions for driving unlicensed, does not drive a motor vehicle.⁴⁶

The AOR is delivered by the handling team to the prospective human source within a timeframe specified in the Human Source Policy.⁴⁷ The human source can then provide information and be ‘tasked’ by police.⁴⁸ Tasking is when handlers give an assignment or instructions to the human source to obtain, or provide access to, information for the benefit of Victoria Police.⁴⁹

One-off registrations

While human sources are typically people with whom police maintain ongoing relationships, in 2020 the Human Source Policy introduced ‘one-off’ registrations, for people who give information to Victoria Police on a single occasion.⁵⁰ The HSMU determines whether to authorise a one-off registration.

In these situations, a One-off Risk Assessment is completed. This one-page assessment is less extensive than the Initial Risk Assessment mentioned above. It requires the officer to, among other things, mark ‘yes’ or ‘no’ to the question: is ‘there any possibility that this information may be subject to legal professional privilege or confidentiality?’⁵¹ If the officer marks ‘yes’, they must contact the HSMU for ‘advice regarding the suitability’ of the one-off registration.⁵² Completion of an AOR and a Mental Health Functioning Screen is not required, but the prospective human source must be invited to sign a Consent for One-off Registration form.⁵³

Once the information provided by the human source is disseminated to investigators, the person will be deactivated as a human source.⁵⁴ If the person seeks to provide further information on a confidential basis within 12 months from deactivation, the regular registration process applies.⁵⁵

The one-off registration process cannot be used for high-risk human sources and those whose registration requires approval by the Ethics Committee (Category 1–4 human sources).⁵⁶

Phase 2: Use and management of human sources

Victoria Police may engage with the human source once they are registered. Officers must make a record of each contact and may disseminate information from the source to investigators.

Victoria Police operates a ‘hybrid’ human source management model. This means that some human sources are managed by a dedicated source team (DST), which consists of officers whose only duties are to manage human sources, whereas other sources are managed by officers with additional responsibilities, such as investigating and detecting crime.

Victoria Police currently has nine DSTs: four across the Commands and five across the Regional Divisions.⁵⁷ Victoria Police produced human source registration data to the Commission indicating that the proportion of human sources being managed by DSTs has increased over recent years, from 61 per cent in June 2017 to 79 per cent in June 2020.⁵⁸

Tenure requirements (or ‘maximum time in position’ rules) apply to certain officers who hold human source management responsibilities, as set out in Box 12.4.

The Human Source Policy imposes various requirements intended to mitigate risk and monitor the management of human sources. These are set out below.

Handling human sources within a ‘sterile corridor’

The ‘sterile corridor’ refers to an arrangement whereby a human source’s handlers are different police officers to those responsible for managing any criminal investigations that may rely on information provided by the source.⁶² According to the Human Source Policy, the central purpose of the sterile corridor is to ensure that the human source’s safety is not compromised through the pursuit of investigative outcomes.⁶³

Acquisition of confidential or privileged information

Where a human source involving legal obligations of confidentiality or privilege provides information to police that appears to be in breach of their legal obligations, the handling team must immediately advise the HSMU and must not disseminate or act on the information.⁶⁴

At the earliest opportunity, the handling team must record in Interpose that the information appears to breach legal obligations of confidentiality or privilege.⁶⁵

The Human Source Policy indicates that the HSMU will then advise the CSR of the matter, who will refer it to the Ethics Committee. The Ethics Committee will review the information and determine how it should be treated.⁶⁶

Supervision and management

The Human Source Policy specifies that ‘supervisors, particularly human source controllers’, are to perform ‘intrusive supervision’ of the handler–source relationship.⁶⁷ Although the policy does not define the term, it states that intrusive supervision must be practised by:

• Understanding the expectations of Victoria Police in managing the inherent risks in human source relationships.
• … situational awareness of tactical deployments of human sources.
• Knowing how, where and when handlers are meeting with human sources.
• … [B]riefing … handling teams following face-to-face contacts and other contacts (e.g. phone contact) where significant information is obtained or changes to risk are identified.
• Ensuring the AOR has been delivered, is appropriate, is being reinforced, remains appropriate and compliance is monitored.⁶⁸

Reviewing and reassessing the human source

The Human Source Policy sets out requirements for the ongoing review of human source files by the handling team and supervising officers:

• Handlers are to reassess risk every three months, or when a change in risk occurs, using the Dynamic Risk Assessment.⁶⁹ This requirement was introduced in May 2020. The controller, OIC and the LSR must all review this assessment.⁷⁰
• Handlers are to review the Mental Health Functioning Screen at least every three months. If relevant issues are identified, they must consult the HSMU.⁷¹
• Controllers must conduct a monthly review ‘of the human source relationship, risk assessment and value of the continued relationship’, and record this in Interpose.⁷² This also includes reviewing the AOR, at least monthly, to ensure its scope and conditions continue to be appropriate and sufficient.⁷³
• OICs are to conduct a three-monthly review of active human source files, including whether they are compliant with policy requirements, which is then reviewed by the LSR.⁷⁴
• LSRs must conduct a monthly review of high-risk human sources, including all human sources involving legal obligations of confidentiality or privilege. This review requires the LSR to confirm that current risk assessments remain ‘fit for the purpose’ and to record in Interpose the checks they undertook to inform that endorsement.⁷⁵

These requirements intersect and are spread across multiple sections of the Human Source Policy.⁷⁶

Audits of human source files

The HSMU oversees all human source files, can review any action taken by members of the handling team, and must notify the LSR if it identifies compliance issues; for example, risk assessments or AORs that are not completed or updated within the specified timeframes.⁷⁷ To inform this process, the HSMU prepares spreadsheets, based on a manual review of Interpose, outlining the compliance status of human source registrations for the LSRs to review.⁷⁸

Additionally, a unit within the ICSC, the Compliance and Risk Management Unit (CaRMU), conducts rolling six-monthly audits.⁷⁹ CaRMU audits aspects of Victoria Police’s human source program, predominantly focusing on the management of high-risk sources, and measures compliance with the Human Source Policy.⁸⁰

Phase 3: Deactivation of a human source

A human source must be deactivated (that is, their registration brought to an end) where:

• there is no longer any operational need for the human source
• the risks have become too high to continue using the human source
• the human source deliberately breaches a condition of the AOR
• the human source has not provided reliable information for at least three months
• the human source has deliberately provided false or misleading information
• the human source is transitioned to the role of a witness in a criminal prosecution (which must be authorised by the Ethics Committee and be subject to a management plan).⁸¹

The Human Source Policy states that if a ‘chance meeting’ occurs between a deactivated human source and the handler, the handler must advise the controller as soon as practicable and submit a report of the contact.⁸²

The Human Source Policy does not contain any further guidance relating to contact with or management of a source following deactivation, including the management of any risks to a deactivated source that might arise from the dissemination of information they provided to police while registered.

Policy exemptions

The Ethics Committee can authorise a departure from procedural or technical requirements under the Human Source Policy. This may include, for example, requirements regarding timeframes for the completion of certain documents. While it is generally not possible to depart from policy requirements relating to Category 1–4 human sources, the Human Source Policy states:

Nothing in this policy is intended to limit the capacity of Victoria Police to receive and use confidential information in a situation that is time critical and where there is an imminent threat to the life or safety of a person or the community …⁸³

Where police perceive that it is necessary to disseminate information provided by a prospective (not yet registered) human source, the handling team must commence the registration process ‘at the first available opportunity’ and, if it relates to a Category 1–4 human source, refer the matter to the Ethics Committee for registration and directions.⁸⁴

Human source management training

The Human Source Policy requires the appointment of ‘appropriately trained’ officers to manage human sources.⁸⁵

The HSMU coordinates and delivers in-house human source management training.⁸⁶ As part of the registration process, the HSMU considers the training competencies of the handling team, and the CSR may direct teams to include officers with a higher level of training and/or require officers to undergo additional training.⁸⁷

General human source management training

Victoria Police delivers the following human source management training courses, listed in order of increasing complexity and specialisation:

• Basic online training course—a course that provides basic awareness of the management and governance of human sources, including definitions, roles, responsibilities, and requirements set out in the Human Source Policy. All officers in the handling team are required to complete this training.⁸⁸
• Intermediate training—a ‘face to face training course that provides handlers and controllers with basic [techniques for] the management of human sources’.⁸⁹ This is recommended for officers who register human sources more frequently.⁹⁰ Human sources who will be tasked must be managed by a handler and controller who have completed this training.⁹¹
• Specialised training—an intensive course that provides handlers and controllers with a deeper understanding of human source management techniques.⁹² Specialised training is designed for officers whose role is primarily management of sources in a DST.⁹³

Training specific to legal obligations of confidentiality or privilege

Victoria Police Deputy Commissioner Wendy Steendam, APM, Specialist Operations, told the Commission that all human source management training mentions the requirement for officers to contact the HSMU to obtain advice about the use of Category 1 human sources.⁹⁴ She also explained that training on issues relating to confidentiality and privilege may be provided by external experts, such as the Victorian Government Solicitor’s Office (VGSO), or provided outside of the human source management context, including in police prosecutors’ courses.⁹⁵

Training requirements for senior officers

The Human Source Policy specifies training requirements for senior officers. Generally, the controller, OIC and LSR are only required to undertake the basic online training.⁹⁶ The controller, however, is required to complete a higher level of training if managing certain types of human sources or involved in tasking them.⁹⁷

This can mean that the handler has received the most specialised human source management training of all the officers in the handling team.

The Human Source Policy does not specify training requirements for HSMU officers, the CSR, members of the Ethics Committee, the Assistant Commissioner, ICSC, or the Deputy Commissioner, Specialist Operations. Victoria Police advised the Commission that, instead, position descriptions for these roles set out the requisite qualifications, skills and experience.⁹⁸

Victoria Police told the Commission that, in practice, it is common for officers involved in the management of human sources to undertake a higher level of training than the minimum requirement, with ‘a large proportion’ of those officers having completed ‘advanced training’. Victoria Police also advised that there are requirements (not outlined in the Human Source Policy) for officers in the HSMU to have received the ‘same training undertaken by handlers and controllers, in addition to other courses in risk management’.⁹⁹

Use and management of human sources in other Australian jurisdictions

Each state and territory in Australia has a dedicated law enforcement agency that operates its own human source program, guided by internal policies and standard operating procedures.¹⁰⁰

Australian law enforcement agencies collaborate in working groups to share knowledge about best practice in human source management and training.¹⁰¹ In consultations with the Commission, agencies identified that best practice principles and features of human source management include:

• review of applications to register human sources by senior officers¹⁰²
• supervision and oversight of the handler–source relationship by senior officers¹⁰³
• maintenance of a sterile corridor¹⁰⁴ (although there was not universal agreement that this constitutes best practice, as discussed below)
• ‘sanitisation’ of information prior to dissemination (that is, the removal of any details that could lead to the identification of the source)¹⁰⁵
• ongoing and regular risk reviews of the human source¹⁰⁶
• training for officers with human source management responsibilities¹⁰⁷
• in some jurisdictions, DSTs.¹⁰⁸

While human source frameworks around Australia are broadly consistent with Victoria Police’s processes, policy differences can arise due to the specific legislative, geographic and operational environment in each state and territory.¹⁰⁹

For example, New South Wales Police does not use sterile corridors, as it does not regard them as best practice. It told the Commission that its approach provides a larger pool of human sources from whom to draw information than would be possible if it used sterile corridors (presumably because it also enables a larger pool of officers to handle sources).

While some law enforcement agencies consider that the sterile corridor helps to protect the identity and thus the safety of human sources, New South Wales Police emphasised that it operates according to an overriding principle of maintaining the anonymity and safety of human sources and manages these risks effectively through robust disclosure and other organisational procedures.¹¹⁰ Other challenges associated with using sterile corridors are discussed later in this chapter. Disclosure requirements and obligations that apply in New South Wales are discussed in Chapter 14.

Tasmania Police told the Commission it adopts different approaches to the use and management of human sources due to its smaller population and police service relative to other states and territories.¹¹¹

The human source policies of most Australian law enforcement agencies do not specifically address the registration and use of human sources involving legal obligations of confidentiality or privilege.¹¹² Most agencies consulted by the Commission indicated that they would determine the appropriateness of using such a source on a case-by-case basis, taking into account the nature and value of the information the source may provide.¹¹³ At the time of these consultations, some Australian law enforcement agencies indicated that they were in the process of updating their policies to include specific guidance on the use and management of human sources involving legal obligations of confidentiality or privilege.¹¹⁴

Northern Territory Police told the Commission that its general policy position is not to use human sources who are bound by legal obligations of confidentiality or privilege, such as lawyers or doctors, but that it may permit their use if the information is unconnected to their occupation or satisfies a legal exception,¹¹⁵ such as under the Evidence Act 1939 (NT).¹¹⁶

New South Wales Police’s policy instructs that, if a lawyer or legal representative is to be registered as a human source, caution should be exercised to ensure that any information provided does not impinge upon or breach obligations of legal professional privilege. It also explains to officers what legal professional privilege is, its purpose and that it can only be waived by the client.¹¹⁷ The policy also warns officers that should New South Wales Police use privileged information for investigative or intelligence purposes, it may be in breach of the Evidence Act 1995 (NSW), which could ‘constitute an abuse of the court process, or be contrary to the interests of justice and bring the law and legal system into disrepute’.

The policy requires that where information from a lawyer or legal representative appears to have been obtained directly or indirectly from a client, police should, in the first instance, ask the lawyer or legal representative whether the information could be privileged and whether they have any evidence that privilege has been waived by the client. If they cannot produce such evidence, the policy states that police should not use the information for any purpose. The policy also directs police to seek advice from senior officers or the Human Source Unit in relation to such matters.¹¹⁸

Federal law enforcement and intelligence agencies in Australia also use human sources. While the objectives and approaches of intelligence agencies reflect significant differences to those of police, aspects of their frameworks provide a useful comparison to the management and oversight of human sources by Victoria Police.

For example, under sections 8A(1) and 8A(2) of the Australian Security Intelligence Act 1979 (Cth), the Minister of Home Affairs issues publicly available guidelines and sets principles that the Australian Security Intelligence Organisation (ASIO) must observe when performing its functions, including when obtaining and evaluating intelligence. In this way, the guidelines ‘form a critical component of the accountability framework that provides assurance that ASIO fulfils its functions consistent with the values of the community it serves’.¹¹⁹

The guidelines specify that in collecting information, ASIO must ensure, among other things, that:

… any means used for obtaining and analysing information must be proportionate to the gravity of the threat posed and the likelihood of its occurrence … [T]he intrusiveness of techniques or methods for collecting information are to be considered in determining approval levels for their use. More intrusive techniques should generally require a higher level ASIO employee or ASIO affiliate to approve their use …¹²⁰

Use and management of human sources in international jurisdictions

Human source practices differ across international jurisdictions and may be governed by legislation, public guidelines and/or internally developed policies.

Victoria Police informed the Commission that, in early 2019, it conducted international research tours in Canada, the United States of America and the United Kingdom to inform its own human source management processes.¹²¹ Some Victoria Police practices are also comparable with those of New Zealand Police, as both agencies are members of various Australasian policing committees and adopt consistent standards.¹²² In examining the adequacy of Victoria Police’s practices, the Commission considered how these jurisdictions approach human source management.

New Zealand

New Zealand Police’s human source management policy does not prohibit the use of human sources involving legal obligations of confidentiality or privilege, but it does state that a source must not be tasked to obtain privileged information.

New Zealand Police advised the Commission that lawyers might approach police on behalf of their clients; for example, to inform them that a client has relevant information about a third party that the client wishes to disclose. It informed the Commission that, in these circumstances, officers would assume that the lawyers are acting lawfully, ethically and in the best interests of their client.¹²³

Registering a human source in New Zealand requires dual approval by the most senior officer within the relevant district and the centralised Human Source Management Unit. If the prospective human source is higher risk, or any significant risks cannot be mitigated, an Officer in Charge of the Human Source Management Unit would be consulted and make a decision.¹²⁴

Canada

The Royal Canadian Mounted Police (RCMP) is responsible for federal law enforcement in Canada and provincial policing in most of Canada’s provinces and territories. The RCMP has an internal policy that governs its use and management of human sources.

Under the RCMP’s model, authorisation to register a human source is granted by a senior officer within a division of the RCMP (usually an officer known as the Criminal Operations Officer) or alternatively by a Superintendent, Chief Superintendent or Assistant Commissioner. For very high-risk prospective human sources, authorisation must be given by RCMP’s National Headquarters.¹²⁵

The RCMP may use people involving legal obligations of confidentiality or privilege as human sources. It told the Commission that this would depend on the circumstances and the nature of the information being provided. If such a person were used, the RCMP indicated it would appoint an experienced handler and ensure close monitoring of the file by senior officers and RCMP’s National Headquarters.

United States of America

In the United States, federal law enforcement is carried out by several agencies administered through the Department of Justice. The Attorney-General is the head of the Department of Justice and the chief law enforcement officer who oversees federal prosecutions, advising on relevant legal matters.¹²⁶

In the early to mid-2000s, the Attorney-General issued guidelines on using human sources (also known as ‘confidential informants’) to ‘set policy regarding the[ir] use … in criminal investigations and prosecutions by all Department of Justice Law Enforcement Agencies’.¹²⁷ These guidelines are:

• The Attorney General’s Guidelines Regarding the Use of Confidential Informants (2002)
• The Attorney General’s Guidelines Regarding the Use of FBI Confidential Human Sources (2006).¹²⁸

The position of the United States Government and relevant agencies is to neither confirm nor deny whether these guidelines are current or have been superseded.

The 2002 and 2006 guidelines set out required processes for registering, assessing and reviewing the use of human sources, as well as for governance and decision making. The guidelines also establish authorisation processes for the registration and use of human sources who are ‘under the obligation of a legal privilege of confidentiality’. Law enforcement agencies are required to establish a committee that is responsible for authorising the use of, and reviewing certain decisions relating to, human sources under such an obligation.¹²⁹

The United States Drug Enforcement Administration (DEA) told the Commission that the use of human sources with legal obligations of confidentiality or privilege, such as lawyers, doctors or journalists, is technically permitted but very rare in practice and subject to stringent safeguards.¹³⁰ It explained that, due to the risks associated with obtaining privileged or confidential information, a United States attorney or federal prosecutor is always involved in the proposal to use such a source from the outset, with the investigation run in conjunction with the prosecution to ensure due process and privacy laws are strictly adhered to.¹³¹

Additionally, the DEA indicated that the proposed registration of a human source with legal obligations of confidentiality or privilege requires review by the DEA Sensitive Activities Review Committee and final authorisation by the United States Attorney-General’s Office.¹³²

United Kingdom

The Commission paid particular attention to the United Kingdom’s human source management framework, given the parallels between Victoria’s common law and human rights systems and those of the United Kingdom, as well as the previous examination of this framework by Victoria Police and the 2012 review undertaken by former Chief Commissioner Neil Comrie, AO, APM (the Comrie Review).¹³³

The United Kingdom framework includes:

• the Regulation of Investigatory Powers Act 2000 (UK) (RIPA), which governs and provides the legal authority for the use of investigatory powers (such as the use of human sources) by public authorities, including police services and other law enforcement agencies¹³⁴
• statutory orders issued by the Secretary of State and the Covert Human Intelligence Sources Revised Code of Practice (Code of Practice) issued by the Home Office; these supplement the RIPA’s procedures and requirements and are all publicly available¹³⁵
• external oversight mechanisms, such as the Investigatory Powers Commissioner’s Office (IPCO), which oversees the use of investigatory powers (discussed further in Chapter 13).¹³⁶

Key features of the United Kingdom’s legislative framework as they apply to human sources are outlined below.

Human rights, necessity and proportionality

The RIPA was established in response to the European Court of Human Rights’ scrutiny of police use of surveillance devices in Khan v United Kingdom.¹³⁷ The Court found that although the conduct of police was consistent with guidelines issued by the Home Office, their use of human sources was inconsistent with the European Convention for the Protection of Human Rights and Fundamental Freedoms (Convention), to which the United Kingdom is a signatory, because there was no legislation authorising the use of these powers and because the powers were used in a way that limited human rights.¹³⁸

The introduction of the RIPA aimed to establish a clear, lawful basis for the employment of investigatory powers, including the use of human sources, and to balance the need for police to combat crime by using certain investigatory powers with the need to protect human rights under the Convention. In doing so, the RIPA specifies that the use of human sources must be necessary and proportionate to what is sought to be achieved.¹³⁹

For authorisation of a human source to be necessary, certain criteria must be satisfied; for example, it is in the interests of public safety or national security, or for the purpose of preventing or detecting crime.¹⁴⁰ The RIPA and Code of Practice use the term ‘authorisation’ when discussing decisions to approve the use of a human source. This chapter generally uses the term ‘registration’ of a source when referring to Victoria Police’s framework, consistent with its Human Source Policy.

The Code of Practice indicates that the consideration of proportionality involves:

• balancing the size and scope of the proposed activity against the gravity and extent of the perceived crime or harm
• explaining how and why the methods to be adopted will cause the least possible intrusion on the subject and others
• [considering] whether the conduct to be authorised will have any implications for the privacy of others, and an explanation of why (if relevant) it is nevertheless proportionate to proceed with the operation
• evidencing, as far as reasonably practicable, what other methods have been considered and why they were not implemented, or have been implemented unsuccessfully
• considering whether the activity is an appropriate use of the legislation and a reasonable way, having considered all reasonable alternatives, of obtaining the information sought.¹⁴¹

Authorisation of human sources generally

The use of human sources by public authorities in the United Kingdom may be authorised by a person who holds a prescribed office, rank or position.¹⁴² Public authorities are not required to apply for an authorisation just because it is available; however, they are advised to do so when they intend to task a person to act as a human source or where they intend to obtain information from a person acting in such a capacity.¹⁴³ For standard authorisations in law enforcement agencies, the authorising officer must be of or above the rank of Superintendent.¹⁴⁴ These authorisations are ordinarily valid for an initial 12 months and must be in writing, unless the use of a human source is urgent.¹⁴⁵

Authorisations of human sources where confidential or privileged information may be acquired

The United Kingdom’s framework provides enhanced authorisation procedures where the use of a human source is intended, or likely, to result in obtaining, accessing or disclosing confidential or privileged information.¹⁴⁶ The Police Act 1997 (UK) (Police Act) defines ‘matters subject to legal privilege’ as any communication between a professional legal adviser and their client (or a person representing their client) that is made ‘in connection with the giving of legal advice to the client’.¹⁴⁷ Similar to Australia, information exchanged in the course of a client–lawyer relationship is not privileged if it is created or held ‘with the intention of furthering a criminal purpose’.¹⁴⁸ The Police Act also provides definitions of ‘confidential personal information’ and ‘confidential journalistic material’.¹⁴⁹

Box 12.5 provides an overview of the enhanced authorisation procedures in the United Kingdom.

Challenges and opportunities

This section sets out the main issues that emerged from the Commission’s assessment of the adequacy and effectiveness of Victoria Police’s processes for the use and management of human sources, including those involving legal obligations of confidentiality or privilege. It draws on a range of evidence from witnesses who appeared at the Commission’s hearings, its focus groups with Victoria Police officers, its audit of Victoria Police human source files, and information provided voluntarily or in response to notices to produce.

Consultations with Australian and international law enforcement, intelligence and justice agencies, and with academics and experts in human source management, also informed the Commission’s understanding of the risks and challenges arising from the use of human sources and helped it identify opportunities for reform. A list of individuals and organisations consulted by the Commission is at Appendix G.

As outlined at the beginning of this chapter, a broad examination of Victoria Police’s human source management framework was necessary to properly assess its practices for identifying and managing the risks of obtaining and using confidential or privileged information from human sources. The need for this broad approach was underscored in the Commission’s engagement with other jurisdictions, where requirements for the use of confidential or privileged information from human sources generally form part of a broader policy and regulatory framework to deal with the varied and intersecting risks associated with the use and management of all human sources.

Overarching framework for the use and management of human sources

As outlined earlier in this chapter, the Human Source Policy sets out requirements for the use and management of human sources. Unlike other covert and intrusive powers and methods used by Victoria Police (for example, telecommunications interception, surveillance devices and controlled operations), there is no legislative framework for, or independent external oversight of, the use and management of human sources in Victoria.

Recognising the significance of these other covert powers and their potential to infringe the rights of individuals, the Victorian and other Australian Parliaments have enacted legislation to establish clear parameters for their use by police and other law enforcement agencies.¹⁶¹ These legislative regimes recognise that the use of such powers involves a balancing of relevant public interests; that is, weighing up the public interest in protecting the rights of individuals against the public interest in detecting and preventing serious crime. In addition to setting out requirements for the use and monitoring of relevant powers and methods, such legislation also specifies who is responsible for approving their use. Typically, this will be either an agency’s most senior officer or a court.

Box 12.6 summarises one such Victorian legislative regime, which sets out requirements for police use of surveillance devices.

External oversight of Victoria Police’s use of covert powers and functions, including by the PIM, is discussed in Chapter 13.

Victoria Police’s Human Source Policy aims, among other things, to manage risks arising from the use of human sources, some of which are comparable to the risks that arise in the use of other covert powers and methods used by police and that are generally governed by legislation. Below, the Commission discusses evidence received about the adequacy of this overarching policy framework, including the extent to which it:

• supports consideration and protection of human rights
• provides an adequate framework to regulate the risks associated with using human sources
• is consistent with the practices adopted by other police agencies across Australia.

Human rights within the human source management framework

As noted above, Victoria Police has obligations under the Charter. In line with these obligations, its officers must give proper consideration to the human rights of people affected by its activities.

One of the human rights protected by the Charter is the right to a fair hearing.¹⁶⁶ Since May 2020, Victoria Police’s Human Source Policy has listed some human rights that are relevant to human source management, but does not refer to the right to a fair hearing.¹⁶⁷ Separate to the Human Source Policy, officers can also consult the Victoria Police Manual Policy Rules—Human rights equity and diversity standards which provides high-level advice on officers’ human rights obligations applicable to all areas of policing.¹⁶⁸

The Human Source Policy notes that under the Charter, human rights can be lawfully limited if there is a proportionate justification that ‘properly considers’ and balances the impacts on a person’s human rights. It states that ‘properly considering’ involves identifying ‘the rights relevant to the decision and whether and how those rights will be interfered with by the decision, and [balancing] the competing private and public interests involved in the decision’.¹⁶⁹ It does not provide practical examples of how officers can fulfil this obligation.

The Victorian Equal Opportunity and Human Rights Commission (VEOHRC) submitted that the Charter should be an integral aspect of the framework for Victoria Police’s recruitment, handling and management of human sources, particularly those who hold legal obligations of confidentiality or privilege. It emphasised that ‘the Charter’s legal framework brings rigour, accountability and fairness to Victoria Police’s conduct, which ultimately instils greater confidence in the administration of justice’.¹⁷⁰

Former police officer Professor Clive Harfield, University of Queensland, noted that intrusion of privacy is inherent in the use of human sources, because a source typically uses deceit to breach an individual’s trust and inform on them to police. He submitted that information obtained from human sources is acquired by infringing upon the ‘fundamental principles of fairness, impartiality and honesty upon which the proper operation of the criminal justice system is founded’, and that this is particularly the case when police have tasked the source. At the same time, Professor Harfield stressed that the use of human sources is ‘justifiable when the harms of not having such information convincingly outweigh the harms inherent in [the criminal justice system] recruiting and exploiting individuals as [human sources]’.¹⁷¹

Under the United Kingdom’s legislative framework, decisions to register a human source must balance the public interest in detecting and preventing crime and the public interest in protecting relevant human rights, such as the right to privacy, the right to life and an accused person’s right to a fair hearing.¹⁷²

The United Kingdom Home Office told the Commission that the primary benefit of the RIPA is its recognition of human rights and provision of a framework that seeks to ensure the use of investigatory powers is lawful, necessary and proportionate.¹⁷³ Several stakeholders from the United Kingdom told the Commission that the RIPA also helps to build public understanding of human rights and the circumstances under which they can be lawfully interfered with by public authorities, including police.¹⁷⁴

Some stakeholders also pointed to the benefits of this legislative framework for law enforcement agencies.¹⁷⁵ For example, the United Kingdom National Crime Agency advised the Commission that, by requiring authorising officers to specifically consider necessity and proportionality, and to document those considerations when determining whether to authorise the use of a human source, the framework helps law enforcement agencies establish the rationale for their decisions, which is particularly important should those decisions ever be challenged.¹⁷⁶

Regulating the risks of human source management through legislation

Human source management is a high-risk activity, covert and intrusive in nature, requiring police to build professional relationships with criminals, and potentially limiting human rights in order to achieve investigatory outcomes. Each of these factors can increase the risk of police corruption and misconduct. Indeed, previous inquiries have suggested that human source management is one of the most significant ethical risks faced by Victoria Police.¹⁷⁷

The Commission heard that both internal and external mechanisms to support accountability in the use of human sources can assist in the earlier identification of issues, help prevent sources being used improperly, and promote a stronger compliance culture among police.¹⁷⁸ Professor Sir Jonathan (Jon) Murphy, QPM, DL, Liverpool John Moores University, told the Commission that the transparency afforded through a legislative regime ultimately strengthens police practices, noting that ‘policing activities that are conducted in secret and without supervision and oversight create corruption and misconduct risks’.¹⁷⁹

The Commission heard from some stakeholders that there is a need for a legislative framework to govern Victoria Police’s use and management of human sources.¹⁸⁰ The Independent Broad-based Anti-corruption Commission (IBAC) observed that the absence of legislation is at odds with the regulatory and oversight arrangements in place for other covert powers and functions exercised by police. It told the Commission:

There are obvious benefits associated with statutory governance, particularly over powers that are inherently coercive or intrusive in nature. The adoption of a statutory framework to regulate the registration and use of human sources specifically has benefits arising from greater transparency of the management of human sources, and the prospect of incorporating mandated principles in the governance of this complex, sensitive and high-risk area of policing activity.¹⁸¹

The Public Interest Monitor (PIM) told the Commission that a legislative model could establish criteria to guide decisions about registering a human source involving legal obligations of confidentiality or privilege and disseminating any information provided by them. These criteria could cover the nature of a human source’s legal obligations, the value of the information expected to be obtained, and arrangements to ensure no privileged material is released, as well as requirements to consider any risks to the source, and whether their registration is in the broader public interest.¹⁸²

Ms Steendam explained that, while ‘there are no specific changes to the legislative and regulatory framework that Victoria Police is advancing’, legislative change would likely be necessary to accommodate any new oversight arrangements.¹⁸³ In the Commission’s focus groups with Victoria Police officers who hold human source management responsibilities, there were mixed views about the need for and value of a legislative framework for the use of human sources, as outlined in Box 12.7.

Greater clarity about the scope of police powers and when they can be used was one of the benefits expected to flow from the introduction of legislation to standardise various covert and intrusive investigative methods across Australian jurisdictions.¹⁸⁴ When introducing the Crimes (Controlled Operations) Bill 2004 (Vic), it was noted in the parliamentary debates that the regulatory regime provided by the legislation would make it easier for police to undertake controlled operations, ‘to define and monitor those operations and ultimately to provide some mechanism of accountability’.¹⁸⁵

Sir Jon expressed similar views about the introduction of the United Kingdom legislative framework. He suggested that police services welcomed the RIPA, recognising that they had previously been operating without clear rules and a clear basis for decision making. He contended that it empowers officers by providing a framework within which they can articulate and justify their decisions.¹⁸⁶

The Commission heard from some United Kingdom stakeholders that the RIPA also enhances public confidence in law enforcement as it means that the use of covert powers is subject to appropriate parameters and oversight, and is therefore less open to speculation.¹⁸⁷ IPCO told the Commission that the legislation provides officers seeking to authorise human sources with confidence that they are acting in good faith and according to the law.¹⁸⁸

The Commission also heard that the United Kingdom model has presented some challenges. The Home Office observed that the RIPA and Code of Practice brought information about certain covert law enforcement powers and processes into the public domain for the first time—and, while noting the benefits of greater transparency and accountability, also emphasised that it can be challenging to balance these with the need to protect the confidentiality of covert tactics.¹⁸⁹

The Home Office told the Commission that one of the challenges of the RIPA, its associated statutory orders and its Code of Practice is the time it takes to develop and pass amendments. The Home Office noted, for example, that it can be difficult to keep up with the pace of technological advancements, which often necessitate the employment of new or enhanced law enforcement powers and techniques.¹⁹⁰

IBAC told the Commission that, while adopting a legislative framework to regulate Victoria Police’s registration and use of human sources would increase transparency and provide an opportunity to set principles for human source management, it would need to provide sufficient flexibility and discretion for police in their management of human sources.¹⁹¹

Likewise, several Australian law enforcement and intelligence agencies emphasised that any legislative model would need to consider and support law enforcement agencies’ operational requirements and capabilities. For example, South Australia Police stated that given the dynamic and fluid nature of managing human sources, it is important that any recommended reforms are clear, practical, able to be adhered to by officers, and flexible enough to respond to operational realities.¹⁹² Queensland Police cautioned against any reforms that might limit the use of human sources, noting that this would greatly compromise police capability to detect and investigate crime.¹⁹³

Based on his experience of the United Kingdom framework, Sir Jon said he had not seen evidence to indicate that the RIPA deters the use of human sources. He noted, though, that no legislative framework can fully protect against human error, inexperience or deliberate misconduct, and that any framework must still ‘be supported by strong [police] leadership and culture that encourages adherence to the highest ethical standards’.¹⁹⁴

National consistency and interoperability

As outlined earlier in this chapter, Australian law enforcement agencies currently use working groups to share knowledge about best practice, including in relation to the use and management of human sources, which provides a level of consistency in policies and processes across jurisdictions.¹⁹⁵ Additionally, these agencies sometimes work together across state and federal legislative and policy frameworks to investigate and prosecute alleged offences—particularly in relation to serious and major crimes. This ability to work across jurisdictional boundaries is sometimes referred to as ‘interoperability’. The Commission considered the extent to which the introduction of new policy or procedural reforms for the use of human sources by Victoria Police might have implications for law enforcement agencies in other Australian states and territories.

Ms Steendam told the Commission that the Australasian Human Source Working Group—which has representatives from each state and territory police service, and from relevant federal agencies—has developed national competencies for human source management training.¹⁹⁶ Then Assistant Commissioner, Neil Paterson APM, ICSC, pointed to national consistency in risk assessment processes across Australian and New Zealand agencies.¹⁹⁷

While many stakeholders indicated that Australian law enforcement agencies use and manage human sources in similar ways and have broadly consistent processes, some also explained that there are differences in policies, decision-making arrangements and organisational models across jurisdictions.¹⁹⁸ As noted earlier, this includes differences related to the registration, authorisation and management of human sources involving legal obligations of confidentiality or privilege.

The Australian Institute of Policing proposed that the use of information from human sources involving these obligations should be standardised across Australian law enforcement jurisdictions. It suggested that this should be undertaken by the affected agencies and/or the Australian and New Zealand Policing Advisory Agency, rather than through legislation.¹⁹⁹

The Australian Federal Police (AFP) told the Commission that it supports nationally consistent principles and practices in the management of human sources because it enhances interoperability between agencies. It said that this is particularly important in the case of multi-jurisdictional investigations and prosecutions, which are becoming increasingly prevalent as criminal networks expand their reach. The AFP noted that if a legislative framework, independent authorisation process or independent oversight mechanism were to be introduced in Victoria, consideration should be given to how this could impact joint taskforce investigations and ensuing prosecutions. For instance, it suggested that issues would arise surrounding the lawful authority of any state-based independent oversight mechanism to require the inspection of any relevant documents in the possession of federal agencies.²⁰⁰

Ms Steendam told the Commission that, due to each jurisdiction having its own framework and operational requirements, there is little scope for a national approach to the use of human sources.²⁰¹ She noted, however, that there is generally no need for human sources to be managed within different jurisdictional frameworks at the same time.²⁰² For example, if Victoria Police made contact with a potential human source who had information pertinent to the investigation of Commonwealth criminal offences, Victoria Police would do one of two things: register the human source, capture the information and disseminate it to the relevant federal body; or introduce the potential human source to the relevant federal body to be managed within Commonwealth frameworks.²⁰³

Other Australian law enforcement and intelligence agencies noted there may be challenges for consistency and interoperability should Victoria adopt a legislative model for the use and management of human sources, but also noted that different frameworks and requirements operate across jurisdictions now. For example, unlike Victoria, most other states and territories do not have human rights obligations under a charter.²⁰⁴

Categorisation of human sources

Victoria Police’s policy framework incorporates various safeguards that apply to human sources involving legal obligations of confidentiality or privilege. For this framework to operate as intended—that is, to prevent the improper acquisition and use of confidential or privileged information—police officers must first be able to identify who these human sources are. If officers are unable to do so, they are also unable to adhere to the policy requirements that apply to these types of sources, such as the requirement to consult the HSMU on the source’s registration, or to refer the matter to the Ethics Committee for consideration.

As discussed in Chapter 11, between 2014 and May 2020, Victoria Police’s Human Source Policy adopted a profession- or occupation-based approach to identifying and managing the risks of obtaining confidential or privileged information from human sources. The policy referred specifically to ‘lawyers, doctors, parliamentarians, court officials, journalists or priests etc’, based on examples listed in the Kellam Report.²⁰⁵ Victoria Police now refers to these as the ‘Kellam Occupations’ or ‘Category 1’ human sources.

Chapter 4 of this final report notes that the critical issue is whether the information provided by a human source is confidential or privileged. A person with an occupation subject to legal obligations of confidentiality or privilege, such as a lawyer, doctor or journalist, might provide information to police that is clearly unconnected to their occupation and not confidential or privileged. Conversely, a person who is not themselves subject to such obligations might access and disclose to police information that is confidential or privileged.

Many Australian law enforcement agencies consulted by the Commission agreed that the critical issue is whether the information itself is confidential or privileged, and whether its value to law enforcement and community safety warrants its use and the associated risks.²⁰⁶

Participants in the Commission’s focus groups expressed similar views, as outlined in Box 12.8.

These views differed somewhat from those of several legal services and legal profession stakeholders; as noted in Chapter 4, some of these stakeholders suggested that any use of a lawyer as a human source (regardless of whether the information relates to a client) presents significant challenges due to, among other things, the difficulty in identifying whether information is confidential or privileged.

As noted above, in May 2020, the Human Source Policy expanded the range of people who might be at risk of providing confidential or privileged information to those with a ‘connection to Category 1’ occupations; that is, those who: previously worked in a Category 1 occupation; are likely to receive confidential or privileged information from a person in a Category 1 occupation; or are in a similar occupation where they are likely to receive confidential or privileged information.

The Human Source Policy does not provide further guidance on the types of individuals ‘likely to receive privileged or confidential information’ or in ‘similar’ occupations; nor does it articulate why using and obtaining confidential or privileged information from a human source may be problematic.

Ms Steendam indicated that a broad range of people might fall into this category, noting that it might include someone who worked in the office of a person with one of the Category 1 occupations, or someone in a relationship with such a person. Ms Steendam suggested, ‘it can be as broad as someone who might incidentally come across that information, say a cleaner who is at perhaps a legal practice, who might overhear something or find something inadvertently’.²⁰⁸

The human source framework in the United Kingdom focuses on the nature of the information to be obtained from a human source; that is, safeguards apply where it is likely or intended that the information is confidential or privileged. The Code of Practice provides examples of information that warrant greater caution but does not specify the occupations or types of people who might hold such material. In reflecting on the United Kingdom model, Sir Jon told the Commission that it is impossible to prescribe every possible scenario or circumstance in policy, noting that it must be broad and flexible enough to capture the myriad of potential situations that may arise and to enable a case-by-case assessment about the nature of the information and associated risks.²⁰⁹

Likewise, Mr Gary Dobson, Director of Policing Programs at Macquarie University, told the Commission that any framework governing human source management must be understandable, easy for police to use, and flexible enough that processes can be adapted to manage the varied and complex risks that arise in the use of human sources. Where it is not, he noted, the risks include officers improperly circumventing the system, or no longer using human sources at all, which could ultimately result in major crimes not being solved.²¹⁰

Registration and decision making

As detailed earlier in this chapter, the Human Source Policy requires multi-levelled review and endorsement of a proposed human source registration. Depending on the type of human source, this process involves five to seven review points. The controller, OIC, LSR, HSMU and CSR are required to endorse all registrations and if the prospective human source falls into Categories 1–4, authorisation by the Ethics Committee is also required. Where there is an intention to use or obtain confidential or privileged material, authorisation must be granted by the Deputy Commissioner, Specialist Operations.

In some circumstances, an officer may wish to approach a prospective Category 1–4 human source to assess whether to submit a registration application. The Ethics Committee is required to authorise any request to ‘approach’ such a source. Victoria Police advised that such a request must be reviewed and endorsed by the controller, OIC, LSR, HSMU and CSR before referral to the Ethics Committee. If the handler decides to then seek registration of this source, the registration application must proceed through the same multi-levelled process, creating the possibility that there may be up to 14 review points before authorisation.²¹¹

The Commission received evidence pointing to various issues relating to Victoria Police’s decision-making model for the registration of human sources, as discussed below.

Accountability and efficiency of decision making

Australian and New Zealand law enforcement agencies consulted by the Commission described multi-levelled processes for the registration of human sources, noting that review by a range of roles and ranks provides more rigorous oversight and assessment of risk.²¹² Northern Territory Police explained that this process means conditions for registration can be added at any stage of the process and facilitates a more objective assessment of the application.²¹³

Ms Steendam told the Commission that Victoria Police’s multi-levelled approach to the review and endorsement of human source registrations allows it to manage the ‘natural tension between appropriate governance, controls and making sure that we are careful in the way in which we manage these issues’.²¹⁴

Most law enforcement agencies consulted by the Commission indicated that their decision-making models involve fewer review points than Victoria Police’s model, with some noting that additional or higher levels of authorisation may apply if warranted by the risk assessment.²¹⁵ Victoria Police’s use of a committee to determine registration applications for certain categories of human sources also differed to the approaches adopted by most other law enforcement agencies consulted by the Commission. In relation to human sources involving potential legal obligations of confidentiality or privilege, Australian law enforcement agencies generally described other processes and practices to support the decision-making process, including the handling team notifying and seeking the advice of senior and/or executive officers, or obtaining legal advice.²¹⁶

As outlined earlier in this chapter, the United Kingdom framework requires the use of a human source by police to be approved by an authorising officer, generally at the rank of a Superintendent, with a higher level of approval by the Chief Constable required where it is likely or intended that confidential or privileged information will be obtained.

Sir Jon outlined the benefits of decision making by dedicated authorising officers; that is, officers who are only responsible for decisions about the use of human sources (and in some cases, the use of other covert powers and functions), rather than officers who are balancing many other operational responsibilities. He indicated that this provides a single point of accountability and supports more rigorous scrutiny and oversight of the registration process and the subsequent handler–source relationship.²¹⁷

While commenting on his own experience in United Kingdom law enforcement rather than specifically on Victoria Police’s decision-making model, Sir Jon expressed the view that the use of committees to make operational decisions can reduce accountability, suggesting that they are better suited to governance and oversight:

I think we train people for roles and we promote them on the basis of their experience, their skills and their judgment and then we hold people accountable for the decisions they make. I am personally not a fan of decisions by committee. I think the role of committees is to hold people accountable for the decisions that they’ve made.²¹⁸

Former Chief Commissioner Kenneth (Ken) Lay, AO, APM told the Commission that many governance arrangements in place during his time at Victoria Police did not support accountability in decision making, and that decisions were often not documented or appropriately reviewed or challenged by senior leaders, particularly in operational policing areas.²¹⁹ He also suggested the absence of a risk and audit committee overseeing high-risk decisions in operational policing was in direct contrast to practices adopted by administrative or corporate areas in policing and by other public sector and private sector organisations.²²⁰

When asked about the reasons for adopting a committee-based decision-making model rather than assigning responsibility to a senior Victoria Police officer, Ms Steendam stated that any decision by the Ethics Committee is ultimately signed off by the Assistant Commissioner, ICSC. This is not specified in the Human Source Policy. Ms Steendam also noted that matters considered by the Ethics Committee are complex and difficult, and consequently need a variety of perspectives to inform and support decisions about registration.²²¹

Box 12.9 and Box 12.10 outline issues related to the decision-making role of the Ethics Committee, observed through the Commission’s audit of human source files and focus groups with Victoria Police officers.

In her evidence to the Commission, Ms Steendam explained that the CSR’s primary responsibility is the management of human source capability for Victoria Police; whereas LSRs (typically Divisional Superintendents) and OICs are expected to manage multiple issues on behalf of the organisation, while also applying careful scrutiny during the decision-making process for human source registrations.²²³

Several participants in the Commission’s focus groups commented on the number of review points in Victoria Police’s current decision-making model, as outlined in Box 12.11.

In her statement to the Commission, Ms Steendam noted that between 1 January 2016 and 9 April 2020, the Ethics Committee convened on 13 occasions. There is no meeting schedule or requirement to convene a minimum number of meetings; rather, meetings are ‘held as and when required’.²²⁴

Ms Steendam explained that Ethics Committee decisions can be made quickly in urgent circumstances, potentially within one day, and that for other, non-urgent matters, it can take up to 14 days or longer for a decision, depending on the issues.²²⁵ She also stated that while in some cases it is appropriate to streamline and make processes more efficient, this needs to be balanced against the risks and the need to protect the prospective human source.²²⁶

Role of legal and other specialist advice

As noted in Chapter 4, issues associated with confidential and privileged information are inherently complex and difficult to navigate.

Victoria Police told the Commission that decisions about Category 1 human sources are informed by legal advice, and that this is generally facilitated by the Executive Director of Victoria Police’s Legal Services Department (or delegate) being a member of the Ethics Committee. In May 2020, the Executive Director, Legal Services became a voting member of the Ethics Committee.²²⁷ Prior to this, a Legal Services Department representative had been a member of the Ethics Committee but they did not have voting rights.²²⁸

Ms Steendam noted that Victoria Police might also seek external legal advice to determine more complex matters, such as through the VGSO or other counsel.²²⁹ For less complex matters, Ms Steendam considered that internal legal advice is sufficiently independent, as the staff providing the advice are unconnected to the work units that submit applications to register human sources. She noted that any decision to obtain external legal advice must consider the efficient use of public resources and, to protect the safety of human sources, the need to limit the number of people aware of their identity.²³⁰

Professor Alexandra Natapoff, University of California, told the Commission that external and independent legal advice can mitigate the risk of internal lawyers being invested in the outcome of a conviction.²³¹ Law enforcement agencies consulted by the Commission generally indicated they would be more likely to seek internal rather than external legal advice.

Mr Paterson identified the increased role of legal advice in the management of human sources overseas, noting that in jurisdictions he had visited, legal advisers are embedded in or operate alongside DSTs. Mr Paterson noted that these agencies consider that this helps to ensure agency compliance with legislative and policy frameworks, and to enable early identification and mitigation of any issues in the use of human sources who may hold legal obligations of confidentiality or privilege.²³²

Law enforcement agencies in the United Kingdom told the Commission that internal legal advisers play an important role in the human source management process. The Police Service of Northern Ireland told the Commission its internal Human Rights Legal Adviser is involved in every aspect of an application to register a human source where it is intended or likely to result in the acquisition of confidential or privileged information.²³³ Similarly, the United Kingdom’s National Crime Agency indicated it would seek internal legal advice where confidential or privileged information is likely or intended to be obtained.²³⁴

Queensland Police told the Commission that while it is not required, in practice, internal legal services often provide advice to inform registration decisions—particularly for those human sources considered to be ‘extreme’ risk.²³⁵ Likewise, Tasmania Police told the Commission that in its human source management framework, officers work closely with the Principal Legal Officer from early on in the decision-making process.²³⁶

External authorisation

As mentioned earlier in this chapter, there is currently no external independent oversight of, or involvement in, the registration of, human sources by law enforcement agencies in Australia. This means that decisions to use human sources involving legal obligations of confidentiality or privilege are made internally by officers and/or senior command, and that these decisions are not subject to dedicated and routine external monitoring.

Issues relating to external oversight of Victoria Police’s use and management of human sources are discussed in Chapter 13.

Identification, assessment and review of risk

At 30 October 2020, and as detailed earlier in this chapter, Victoria Police used three risk assessments to consider the suitability of a prospective human source: the Initial Risk Assessment, the Dynamic Risk Assessment and the One-off Risk Assessment.²³⁷

In May 2020, Victoria Police advised the Commission that the Initial Risk Assessment was under review, and that it intended to implement a new risk assessment by December 2020.²³⁸

The Commission received evidence about the adequacy of Victoria Police’s risk assessment processes relating to issues of confidentiality or privilege and human rights, and about the overall usability of the risk assessment tools. These matters are addressed below.

Risk assessments: Issues of confidentiality and privilege

Similar to Victoria Police’s policy framework for the use of human sources, the Initial Risk Assessment focuses on identifying a prospective human source’s occupation, rather than the nature and origin of the information that may be obtained. It requires officers to consider whether a prospective source is occupationally bound by other duties that may give rise to legal, ethical or medical privilege considerations.²³⁹ The identification of these duties determines what safeguards will be applied under the Human Source Policy.

Beyond considering a prospective human source’s occupation, the Initial Risk Assessment does not seek to identify the likelihood of confidential or privileged information being provided; nor how any associated risks will be mitigated.

Victoria Police’s more recently developed Dynamic Risk Assessment and One-off Risk Assessment require consideration of whether the information provided by the source could be confidential or privileged by the officers completing the assessments.²⁴⁰

Several participants in the Commission’s focus groups commented on practices for identifying confidential or privileged information, as outlined in Box 12.12.

Under the Human Source Policy, officers who identify that a prospective human source is likely to receive confidential or privileged information must refer the matter to the CSR via the HSMU, which in turn must refer it to the Ethics Committee for a decision.²⁴¹

The Commission heard that, in these circumstances, a condition would be included in the AOR stating that the human source is not to provide confidential or privileged information (unless explicitly authorised by the Deputy Commissioner, Specialist Operations). Ms Steendam explained that while the Human Source Policy does not mandate the inclusion of such a clause in the AOR, in practice the Ethics Committee would require its inclusion alongside any other requirements specific to the circumstances.²⁴²

Risk assessments: Human rights, necessity and proportionality

Unlike in the United Kingdom, the concepts of necessity and proportionality are not explicitly set out in Victoria’s Charter, but are recognised as key concepts in human rights law.

In its submission to the Commission, VEOHRC explained that the lawful limitation of a human right is justified following an assessment of the nature of the right, the importance, proportionality, nature and extent of the purpose of the limitation, and whether there is ‘any less restrictive means reasonably available to achieve the purpose that the limitation seeks to achieve’.²⁴³ Any limitation of rights must also be necessary and reasonable.²⁴⁴

According to former Chief Commissioner of Victoria Police, Mr Comrie, decisions to use a human source must be underpinned by a robust and effective risk assessment process that includes consideration of whether use of a human source is legitimate, necessary and proportionate.²⁴⁵

In the context of human source management, an assessment of necessity and proportionality would involve considering any limitation of human rights and might also involve considering broader risks to the organisation. For example, the safety and reputational risks associated with registering a human source with a significant criminal history must be balanced against the seriousness of the crime police are seeking to prevent or prosecute.

Victoria Police’s risk assessment tools do not prompt a human rights assessment for prospective or registered human sources. In evidence before the Commission, Ms Steendam indicated that all officers involved in the human source registration process are responsible, when commencing the registration application process, for assessing whether it is necessary and proportionate to register a human source.²⁴⁶ Ms Steendam said that this is a separate process to a risk assessment, and takes into account the findings of that assessment, the details of the registration documentation and any risk mitigations.²⁴⁷ The Human Source Policy does not reflect this separate process.

Sir Jon explained that as part of assessing necessity and proportionality in the United Kingdom, ‘officers responsible for conducting and authorising such activity ought to be thinking through at the outset whether they can reasonably justify the activity in the face of any future scrutiny’.²⁴⁸

Under the United Kingdom’s Code of Practice, assessing proportionality involves officers identifying the ‘least possible intrusion’ on human rights, and turning their minds to ‘what other methods had been considered and why they were not implemented, or have been implemented unsuccessfully’.²⁴⁹ Where there is an intention to obtain legally privileged material, the Code of Practice also sets a higher threshold to satisfy the concepts of necessity and proportionality, requiring authorising officers to set out in the application the ‘exceptional and compelling circumstances’ that necessitate the registration.²⁵⁰

The usability of risk assessment tools

Mr Dobson emphasised the importance of risk assessments being easily used and understood by officers. He noted that overly complex risk assessments can be a disincentive to officers using human sources and may therefore limit the ability of police to solve major crimes. To this end, he noted the reduced number of registered human sources in New South Wales following the introduction of the risk assessment process after the 1997 Royal Commission into the New South Wales Police Service.²⁵¹

As outlined in the 2010 Victoria Police Audit of Victoria Police Human Source Management Practices, risk assessments should include all relevant information on the prospective human source and their circumstances, along with an honest and accurate assessment of whether the person is suitable for use as a human source. This enables the handling team to develop a comprehensive plan for managing the identified risks and ensures that supervising officers are aware of all the risks.²⁵²

The usability of Victoria Police’s human source management risk assessments was raised by officers who participated in the Commission’s focus groups, as outlined in Box 12.13.

Victoria Police’s Human Source Strategy 2018–2022, an internal draft document prepared in 2018, indicated that the Initial Risk Assessment was not fit for purpose and was contributing to non-compliance with policy requirements.²⁵³

In evidence before the Commission, Ms Steendam indicated that the Initial Risk Assessment is being refined with the assistance of a senior forensic psychologist who has expertise in designing risk assessments.²⁵⁴ When asked whether the risk assessment is potentially being viewed as a ‘tick and flick’ exercise among officers, Ms Steendam explained:

That first risk assessment is quite lengthy … there’s a review process being undertaken … to see if there’s opportunity to refine that process and make it more specific … and make it more streamlined for this very reason, to assist our handlers in the completion of that form.²⁵⁵

Supervision of the human source–handler relationship

Law enforcement agencies consulted by the Commission agreed that close supervision of the human source–handler relationship is a critical aspect of human source management and should form part of a broader risk management and governance structure that supports the ethical and proper handling of human sources.²⁵⁶

In combination with other safeguards and risk mitigation strategies, effective supervision:

• encourages compliance with human source policies and keeps officers accountable²⁵⁷
• helps to manage key risks associated with human source management (such as corruption, breaches of confidentiality relating to the source’s identity, and risks to prosecutions and the administration of justice)²⁵⁸
• assists in identifying administrative errors or discrepancies that could be concealing wrongdoing.²⁵⁹

The Commission consulted with serving Western Australia police officer and Adjunct Associate Professor Dr Charl Crous, APM and Associate Professor Pamela Henry, Edith Cowan University. They advised that in the context of human source management, ‘intrusive supervision is key, including coordinated self-reflection, critical-assurance and appraisal of performance. [It] leads to improved self-practices … which continues after formal training has concluded’.²⁶⁰

Stakeholders consulted by the Commission emphasised that human source policies and systems are not foolproof, and there is always a risk that officers will act outside required approval processes and management controls, either intentionally or through ignorance.²⁶¹ Western Australia Police and Sir Jon indicated that effective supervision aids in detecting this type of improper conduct.²⁶²

The adequacy of supervision

In her evidence to the Commission, Ms Steendam noted that in a practical sense, exercising ‘intrusive supervision’ means that officers with supervisory responsibilities:

… are active, that it’s not just a tick box, that they actually have active conversations, look at the risks that have been identified and make sure that the mitigations are appropriate.

… It’s ensuring that the OIC and the controller are exercising the supervision requirements that they need to across the source and how they’re managing that in a tactical sense. It’s also to make sure that continuation of that relationship is appropriate. So it crosses over multiple and varied parts of their responsibility.²⁶³

Ms Steendam told the Commission that all officers in a human source chain of command should be practising effective supervision, including the Assistant Commissioner, ICSC, and noted that the Human Source Policy makes this clear.²⁶⁴

Mr Paterson said that ‘the failures that have occurred in relation to Ms Gobbo could not occur in the context of our current policies, intrusive supervision and governance framework’.²⁶⁵

In its focus groups with Victoria Police officers, the Commission explored how supervision was being exercised across Victoria Police’s human source management functions.²⁶⁶ Key observations from the focus groups are summarised in Box 12.14.

Victoria Police produced other information to the Commission that pointed to challenges in achieving effective supervision of human source management across the organisation. Its draft Human Source Strategy 2018–2022 suggested that:

• officers involved in supervision and governance were not prioritising compliance with human source policy over other duties
• there was a lack of consistent supervision and governance, leading to a failure to comply with policy
• LSRs relied heavily on the OIC and the controller to supervise handlers, but often all three of these roles failed to provide the level of supervision required.²⁶⁷

The document indicated that inadequate supervision could have resulted from managers:

• having little interest in, or intentionally or recklessly ignoring, compliance obligations due to competing priorities
• having no background in investigations and/or prosecutions
• having no training in relation to their specific role and responsibilities
• demonstrating an absence of ownership over their position due to acting arrangements, as opposed to being appointed for a certain period.²⁶⁸

Sir Jon told the Commission that having an authorising officer with a dedicated focus on human source management facilitates effective supervision, noting that such officers are better positioned to actively challenge controllers and handlers in their use of a source and how they propose to manage identified risks.²⁶⁹ Likewise, former police officer Dr Adrian James, Liverpool John Moores University, explained that effective supervision can prevent administrative errors along with more serious wrongdoing.²⁷⁰

Human source management training

The Commission heard that, generally, training for officers responsible for human source management is delivered consistently across Australian law enforcement agencies in the form of basic online training, intermediate training and specialised training. The Commission heard of similar tiered training frameworks operating in Canada, New Zealand and Scotland.²⁷¹

In May 2020, Ms Steendam advised the Commission that Victoria Police was reviewing the training requirements for officers involved in human source management.²⁷² To inform this review, the Commission discusses below five key themes relating to Victoria Police’s human source training that emerged during its inquiry:

• the adequacy of basic training for people who handle and manage human sources
• the adequacy of training for senior officers with human source management or registration responsibilities
• the absence of ongoing or ‘refresher’ training
• the extent to which human source management training supports an understanding of human rights obligations
• the extent to which human source management training covers obligations of confidentiality or privilege.

Adequacy of basic online training

As noted earlier in this chapter, police officers who directly manage or supervise the use of human sources are required, at a minimum, to complete Victoria Police’s basic online training.²⁷³ As the majority of officers complete this training, rather than intermediate or specialised modules, the Commission considered the adequacy of this training and its ability to support officers to manage human sources ethically and in accordance with the Human Source Policy.

A Victoria Police Human Source Management Training Evaluation Report, completed in December 2019, noted that the basic online training is intended ‘to effectively train a large volume of serving [officers]’. It stated that while the basic training was updated in August 2019 to align it with the Human Source Policy, the risk is that an online course may not be sufficient to mitigate the risks associated with human source management to both the individual and the organisation.²⁷⁴

According to the evaluation report, a key barrier to introducing more effective training is Victoria Police’s current hybrid model for human source management; that is, any new or improved basic training would need to be delivered to the large number of officers who are permitted to manage human sources under this model.²⁷⁵ In contrast, under a dedicated model, only officers in dedicated source handling roles would be able to manage human sources, thus reducing the number of officers requiring training.

The Commission discussed the basic online training with focus group participants, as outlined in Box 12.15.

The Commission consulted with Dr John Buckley, a former United Kingdom police officer with experience in the delivery of human source management training. Dr Buckley told the Commission that the benefit of online training is its ability to reach a large group of officers and teach them basic rules and principles, and suggested that more in-depth training is necessary to teach an officer how to effectively and safely manage a human source. Dr Buckley noted:

Online training could be used to teach officers the difference between a member of the public providing information and a human source. In particular, online training could outline the process officers should follow where they receive information from a member of the public, and then reiterate that only specialised officers can manage human sources.²⁷⁶

Adequacy of training for senior officers

As noted earlier in this chapter, there are no mandatory human source management training requirements for HSMU officers, the CSR, members of the Ethics Committee, the Assistant Commissioner, ICSC, or the Deputy Commissioner, Specialist Operations. Additionally, the OIC and LSR are not required to complete human source management training beyond the basic online course.²⁷⁷ Controllers are only required to complete a higher level of training when they are supervising the use of certain types of sources, or where a source is being tasked.²⁷⁸

In practice, officers in these senior roles might have completed relevant training despite the lack of a formal policy requirement for them to do so. For example, officers appointed to roles in Executive Command or the Ethics Committee may have received training in relation to risk management, ethical leadership and application of the Charter,as well as other training specific to their roles and responsibilities.²⁷⁹

Ms Steendam told the Commission that, although there are no specific human source qualifications required for the CSR role, the officer currently holding the role of CSR has completed extensive specialist training. She explained that extensive policing and risk management experience are prerequisites for the CSR role.²⁸⁰

Ms Steendam also informed the Commission that, because the responsibilities of supervising officers are focused on governance, risk management and ‘intrusive leadership’, the current human source training offered by Victoria Police is ‘not fit for purpose’ for these types of senior roles.²⁸¹

In a submission to the Commission, Victoria Police similarly emphasised that the training undertaken by senior officers is necessarily more focused on systemic risks and is therefore different to the training delivered to officers responsible for handling and interacting with human sources.²⁸² Victoria Police also advised that it is reviewing training for LSRs with a view to incorporating a greater focus on human rights, risk and governance as it applies to human source management.²⁸³

The Commission discussed the adequacy of training for senior officers with participants at its focus groups, as outlined in Box 12.16.

Some international stakeholders consulted by the Commission referred to training designed specifically for senior human source management roles, such as authorising officers and controllers.²⁸⁴

Sir Jon told the Commission that the lack of formal training in human source management for authorising officers is a key risk for law enforcement agencies, particularly when high-risk human sources are being considered for registration.²⁸⁵ He noted that without such training, there is a danger that authorising officers will not actively challenge handlers and controllers in relation to their use and management of human sources, or be able to identify the accompanying ethical risks.²⁸⁶ In addition, he suggested that when the successes of individual officers go unquestioned by leaders, it can create a ‘breeding ground for conduct that blurs criminal and ethical boundaries’.²⁸⁷ Sir Jon emphasised that:

… officers need to be provided with the requisite training to support them in navigating challenging operational and ethical situations. This is true for all officers involved in human source management, at all levels.²⁸⁸

Absence of ongoing or ‘refresher’ training

The Commission heard that most Australian law enforcement agencies do not have formal ‘refresher’ courses; nor do they require officers to repeat human source management training periodically. Some agencies do, however, encourage officers to re-attend training when course content is updated.²⁸⁹ Consistent with other jurisdictions, Victoria Police does not provide ongoing or ‘refresher’ training, but it advised the Commission that all officers involved in human source management received additional training associated with changes to the Human Source Policy in 2020.²⁹⁰

The Commission discussed ongoing training with focus group participants, as outlined in Box 12.17.

During the inquiry, Victoria Police confirmed that its hybrid human source management model is a barrier to the delivery of ongoing human source management training. It also noted that if it were to move to a centralised model—where only one Command or Division is responsible for human source management—it would be in a better position to consider implementing requirements for ongoing training.²⁹¹

Human rights training

In August 2019, Victoria Police updated the basic online training to expressly refer to human rights obligations. This included listing some Charter rights relevant to human source management: the right to life; the right to privacy and reputation; the right to freedom of thought, conscience, religion and belief; the right to protection of families and children; the right to peaceful assembly and freedom of association; cultural rights; and rights in criminal proceedings.²⁹² While these rights are listed, they are not discussed in detail and there is no accompanying practical guidance.

Victoria Police confirmed that officers undertaking intermediate training and Ethics Committee members (as outlined above) receive training on the Charter and relevant human rights considerations.²⁹³

A training evaluation undertaken by Victoria Police in 2019 recommended the roll-out of new competencies to help controllers and handlers understand not only human rights theory, but also how to consider human rights in human source management from a practical perspective.²⁹⁴

In September 2020, Victoria Police acknowledged it could do more to provide guidance to police officers on how to apply human rights in practice, including considerations of necessity and proportionality, noting that this will be a priority in future. It advised that human rights will soon be included in the specialised training and, as noted above, that training for LSRs is being reviewed to embed a greater focus on human rights, among other things.²⁹⁵

The Commission discussed human rights training with focus group participants, as outlined in Box 12.18.

The United Kingdom College of Policing told the Commission that it aims for human rights to be at the forefront of its policing practice training materials.²⁹⁶ Sir Jon indicated that incorporating human rights considerations in human source management training supports officers to properly balance the risks and potential impacts of their decisions and actions in managing human sources.²⁹⁷

Training about legal obligations of confidentiality and privilege

Victoria Police informed the Commission that in November 2019, officers from the HSMU received a training presentation delivered by the VGSO that focused specifically on the laws relating to professional privilege. In March 2020, Victoria Police made this presentation available to officers from DSTs.²⁹⁸

In May 2019, Victoria Police updated the basic online human source management training to include content relating to legal obligations of confidentiality or privilege.²⁹⁹ The training broadly reflects the Human Source Policy, asking officers to consider if the prospective human source is subject to legal obligations of confidentiality or privilege or if they are providing information received from someone who is. It advises that if these circumstances exist, the officer is to contact the HSMU at the earliest opportunity, and prior to receiving information from such a person.³⁰⁰

The Commission discussed training about legal obligations of confidentiality or privilege with focus group participants, as outlined in Box 12.19.

The College of Policing, United Kingdom, told the Commission that most human source training courses in the United Kingdom cover the management of confidential and privileged information.³⁰¹ Dr Buckley told the Commission that the commencement of the RIPA resulted in changes to human source training to encompass officers’ obligations under the legislation and associated guidelines, including changes to help officers identify privileged material.³⁰²

Ms Steendam explained that changes being made to Victoria Police’s human source management training will cover, among other things:

… [the] identification of human sources with a legal obligation of privilege or confidentiality, as well as those with a connection to those persons, and address the procedures in place under the [Human Source Policy] for managing human sources of this type.³⁰³

System capability

Victoria Police advised the Commission that Interpose was first developed in 2005 as an intelligence and case management system and ‘has been improved and modified within [the limits of] its functionality’.³⁰⁴ Victoria Police began using a human source management module within Interpose in 2008. Prior to that, it used a paper-based system to manage human source records.³⁰⁵

Victoria Police told the Commission that the human source management module within Interpose was upgraded in October 2019 to ‘increase the capacity of Victoria Police and handling teams to comply with policy’, including the Human Source Policy.³⁰⁶ As discussed earlier and in Chapter 11, the upgrade introduced fields and prompts related to a prospective human source’s occupation. This is the main way that the system supports identification of potential issues related to legal obligations of confidentiality or privilege.³⁰⁷

Interpose does not currently contain a separate field for officers to indicate that, beyond the occupation of the human source, there is a risk that the source may provide, or has provided, confidential or privileged information.³⁰⁸

The Commission discussed Interpose capability with focus group participants, as outlined in Box 12.20.

Victoria Police informed the Commission that it will continue to enhance the functionality of Interpose where possible, but that new systems are likely to be required for any significant improvement.³¹⁰ It indicated that it is planning for a new case management system to replace Interpose, which will include a human source management module.³¹¹ Ms Steendam noted that this new system, which she described as ‘intuitive’, would support the registration, oversight and auditing of human sources and would require additional investment and resourcing.³¹²

Internal monitoring and audit

As noted earlier in this chapter, separate to the review of individual human source files by supervising officers, the primary mechanisms Victoria Police adopts for program-wide audit of human source files are:

• review of files and preparation of compliance spreadsheets by the HSMU, outlining the status of human source registrations for review by the LSR
• compliance audits by CaRMU, particularly in respect of high-risk human sources, conducted every six months.³¹³

These audits are not mentioned in the Human Source Policy.

In evidence before the Commission, Ms Steendam said that, due to the requirements under the Human Source Policy for the multi-levelled review of registration applications, regular review of human source files by supervising officers, supervision of the source–handler relationship and the HSMU’s oversight, Victoria Police’s human source files are, in effect, ‘constantly being audited’.³¹⁴

The evidence provided to the Commission on the adequacy of the HSMU and CaRMU audit mechanisms is set out below, along with Victoria Police’s identification of, and response to, non-compliance in the use and management of human sources.

Adequacy of internal monitoring and audit mechanisms

Two key themes emerged during the Commission’s inquiry regarding audit of human source files and records:

• that regular and comprehensive audits are critical to the organisation’s ability to assess levels of policy compliance and detect discrepancies or inappropriate practices
• that they should ideally be undertaken independently; that is, by a unit or officers other than those who are responsible for undertaking the work being audited.

Dr James told the Commission that internal monitoring and audit are essential to managing risks associated with human source management programs and should complement other governance and oversight mechanisms.³¹⁵ Mr Dobson told the Commission that any audit process should not only be clearly understood by the officers being audited, but also managed in a way that can withstand informal influence.³¹⁶

Some Australian law enforcement agencies told the Commission that they had strengthened internal monitoring of human source management through regular reviews and/or formal audits of human source files. They indicated that reviews are generally carried out by supervising officers or centralised units, while formal audits are carried out by professional standards commands or central audit teams that are functionally separate to the agency’s human source management program.³¹⁷ Tasmania Police told the Commission that while its audits are conducted by senior officers involved in decision making associated with human sources, the audit results are sometimes reviewed by a centralised area, such as a professional standards unit.³¹⁸

Some stakeholders emphasised the importance of an audit program that is flexible and takes into account the dynamic and fluid nature of human source management, such as changes to the nature and level of risk posed by the human source, and the organisation’s relationship with the source.³¹⁹

CaRMU is structurally separate from Victoria Police’s human source management program, whereas HSMU officers responsible for review and oversight are also involved in the provision of advice to handlers about registering and managing human sources, and decisions about source registration and management.

Ms Steendam informed the Commission that CaRMU’s most recent audits examined compliance with:

• responsibilities and procedures
• the registration process
• risk assessment practices, including whether the controller evaluated the risk assessment and ensured that sufficient mitigation strategies were in place
• contact with human sources
• audit and compliance monitoring by supervising officers.³²⁰

Victoria Police informed the Commission that CaRMU’s audits focus primarily on high-risk sources because the consequences of non-compliance with the Human Source Policy ‘in the context of high-risk sources are likely to be magnified’. It noted that automated audit processes within Interpose, which are monitored by the HSMU, apply to all human sources, not just high-risk sources.³²¹

Although not required by policy, Ms Steendam informed the Commission that any audits identifying compliance issues would be reported back to supervising officers, and any significant issues would be raised with the Assistant Commissioner, ICSC and the broader leadership team for discussion.³²²

When asked whether these issues are also reported to Victoria Police’s Audit and Risk Committee, Ms Steendam told the Commission that she did not believe this occurs.³²³ The Audit and Risk Committee consists of members of Victoria Police’s Executive Command and independent members from outside of Victoria Police. Its purpose is to provide independent assurance and assistance to the Chief Commissioner on ‘governance, risk, control and compliance frameworks and its external accountability responsibilities’, as well as to consider recommendations from internal and external auditors.³²⁴

In the Commission’s focus groups with Victoria Police officers, some participants said that the current internal audit mechanisms are overly focused on high-risk sources, as outlined in Box 12.21.

Identifying and responding to non-compliance

In June 2018, CaRMU conducted an audit of all Victoria Police human source files. It found that over 60 per cent of files were not compliant with the Human Source Policy. Victoria Police informed the Commission that most instances of non-compliance related to administrative or technical issues, with one instance involving the dissemination of information before a human source had been registered.

Following the audit, Victoria Police briefed IBAC on the non-compliance issues and Mr Paterson sent an email to all LSRs reminding them of requirements under the Human Source Policy.³²⁵ The human source files identified as non-compliant were suspended, preventing the dissemination of information obtained from those human sources.Relevant handling teams were asked to either deactivate the human source or remedy the non-compliance.³²⁶

Victoria Police’s draft Human Source Strategy 2018–2022 noted that:

• continued poor compliance with human source policy, due to a bureaucratic registration process, competing priorities for the handling team and an ineffective governance framework, ‘is likely to seriously damage Victoria Police’s reputation’
• audit results indicate a system-wide failure of appropriate local governance
• the introduction of an independent auditing process is critical to ensuring that issues identified by previous inquiries into Victoria Police’s human source management are not repeated.³²⁷

The Commission examined Victoria Police’s compliance with the Human Source Policy in its audit of human source files. Its observations are outlined in Box 12.22.

Use, handling and dissemination of confidential and privileged information

The Human Source Policy provides safeguards for the handling of information in circumstances where a human source subject to legal obligations of confidentiality or privilege volunteers information to police ‘that is or appears to be in breach of that obligation’.³²⁸ In these circumstances, police must not act upon or disseminate the information and the HSMU and Ethics Committee must be advised. Since May 2020, the Human Source Policy has specified that if Victoria Police wishes to disseminate the information to investigators, this must be authorised by the Deputy Commissioner, Specialist Operations.³²⁹

It appears that the same or a similar process applies to confidential or privileged information provided by human sources who are not in an occupation bound by legal obligations of confidentiality or privilege,³³⁰ though the Human Source Policy lacks clarity on whether this is the case.

The PIM advised the Commission that it believes existing police procedures for other covert methods, such as the use of telecommunications intercepts and surveillance devices, prevent the release of privileged information to investigators, intelligence analysts and other agencies. Those procedures require that the information is quarantined and reviewed by a lawyer who will only release the information if it is determined that no privilege applies.³³¹ There is no such requirement under the Human Source Policy.

The Commission sought information from Victoria Police on its policies and procedures related to the handling, use and dissemination of confidential or privileged information obtained through the use of other police powers. Victoria Police declined to provide the Commission with this information on the basis that it was not relevant to the Commission’s terms of reference, notwithstanding the broad scope of term of reference 6.³³²

Victoria Police did, however, produce a statement to the Commission outlining that, if it obtains legally privileged information through telephone intercepts, it quarantines this information to prevent it being used as intelligence or disseminated to an investigation team.³³³ In October 2020, Victoria Police advised the Commission it had recently identified that privileged information obtained from telephone intercepts had not been fully quarantined and it was working with IBAC and the Victorian Director of Public Prosecutions to address this issue.³³⁴

The United Kingdom’s Code of Practice contains detailed guidance relating to the use, handling, dissemination, retention and destruction of confidential and privileged information that police may receive, including the requirement to obtain legal advice for the acquisition and use of privileged material.³³⁵ The Code of Practice also provides that all human source material must be handled in accordance with the relevant agency’s safeguards and that these safeguards should be made available to IPCO.³³⁶

Organisational model

Ms Steendam described Victoria Police’s current hybrid organisational model for the management of human sources, noting that:

… across Victoria Police there is currently a mix of dedicated human source units in some work areas, and in other work areas, investigators will be handling their own human sources.

The current framework is based on each operational superintendent deciding if they will take resources from other units within their division to create a dedicated human sources team rather than an agreed organisational structure and allocation of resources.³³⁷

Participants in the Commission’s focus groups explained that, under this model, whether a local division has a DST is determined by the Divisional Superintendent (who typically performs the LSR role), based on the nature of crime in an area, the resources available, and the Superintendent’s attitude to, and experience in, human source management. Several participants suggested that some Superintendents are unwilling to divert resources from other priorities or to take on the risks associated with managing human sources.

In contrast to a hybrid model, a centralised model would likely see all DSTs reporting to one central Command or Division; that is, there would be no regionally managed DSTs or ad hoc local arrangements for the management of human sources by officers undertaking other duties unrelated to human source management.

The Commission discussed Victoria Police’s human source management organisational model with focus group participants, as outlined in Box 12.23.

Ms Steendam noted that a key benefit of the hybrid model of human source management is that it allows Victoria Police business areas to determine their own priorities, while retaining dedicated and specialised units to give guidance to, and build the capability of, officers who are not in dedicated human source management roles.³³⁸ At the same time, Ms Steendam acknowledged similar limitations of the current model to those identified by the focus group participants.

In December 2019, Victoria Police Executive Command provided in-principle support for a more centralised model, subject to further development of the resourcing allocation, delivery model and investment requirements. Ms Steendam indicated that the inclusion of DSTs, enabling effective supervision and consistent practice in the management of human sources, would be a key principle guiding the future approach to the organisational model.³³⁹

Victoria Police did, however, advise the Commission of challenges associated with adopting a centralised model, including the current lack of a centralised information management system, ‘the size and diversity of Victoria Police’s jurisdiction’, and ‘the potential lack of suitable police resources with the required attributes, particularly in regional areas, to effectively implement and use [DSTs]’.³⁴⁰

Western Australia Police is the only Australian law enforcement agency with a fully centralised model, even though it is the largest geographically of all the states. It told the Commission that this model is critical for the effective management and protection of human sources, particularly those who are high-risk, and noted that while maintaining this model comes at a high financial cost, the overall benefits outweigh the costs.³⁴¹

Human sources are also managed by DSTs in the United Kingdom, with the Code of Practice noting that ‘dedicated and sufficient resources, oversight and management’ are needed to manage the impacts and risks of using human sources.³⁴²

The Police Service of Northern Ireland told the Commission that officers in its DSTs have a sophisticated understanding of the risks associated with the use of human sources, including those related to obtaining and using privileged information. It noted that while dedicated units reduce capacity for the use of human sources across the organisation, this needs to be balanced against the need for sources to be properly handled.³⁴³ While noting the benefits of DSTs, Sir Jon also acknowledged the geographical challenges of this model in Australia, where policing service areas are much larger than those in the United Kingdom.³⁴⁴ Noting that dedicated models can pose ethical risks, including officers becoming overly familiar with sources, he emphasised that a tenure (or ‘maximum time in position’) policy should be in place to mitigate these risks.³⁴⁵

Police Scotland told the Commission that a dedicated model clarifies who is responsible and when matters should be escalated to management for oversight and direction, while also enabling more effective and targeted pursuit of policing priorities.³⁴⁶

The Metropolitan Police, United Kingdom, told the Commission that the benefits of DSTs include compliance with the management structure as required by the RIPA, separation of intelligence-gathering from the evidentiary chain, and corruption prevention, but also noted that taking officers out of investigative roles can limit their skill sets and isolate them.³⁴⁷

A 2004 Victoria Police review entitled Review and Develop Best Practice Human Source Management suggested that DSTs result in higher standards of professionalism, better source control, and more focused recruitment of sources to support policing objectives. It also acknowledged that the corruption risks need to be mitigated by active management and oversight of the source–handler relationship, tailored selection processes, training and a tenure policy for the handling team.³⁴⁸

In contrast, other reviews of Victoria Police’s human source management framework found that the dedicated model resulted in poor work practices, disregard for management and governance, and a culture of risk taking.It identified that, when not implemented correctly, these models can raise significant health and safety concerns for staff, and increase risks of improper relationships between handlers and sources.³⁴⁹

The sterile corridor

The Commission heard that another key advantage of DSTs is the ability to maintain a ‘sterile corridor’. As outlined earlier in the chapter, this is where the management of a human source is undertaken by different officers to those who are responsible for the management of any investigations that may rely on information provided by the source.

The Human Source Policy specifies that:

• a full sterile corridor is where investigators are unaware of the existence of a human source
• a partial sterile corridor is where investigators are aware of either the existence, or the identity, of a human source.³⁵⁰

The policy states that, where possible, ‘human sources should be managed in either a partial or full sterile corridor’, and ‘a partial or full sterile corridor must be employed in the management of all high-risk human sources’.³⁵¹ There is no information on the circumstances that would warrant dispensing with this requirement.

Most Australian and international law enforcement and intelligence agencies described the use of a sterile corridor as an important feature of their human source programs.³⁵² They noted that it prioritises a law enforcement agency’s duty of care to the human source, and reduces the burden on investigators—allowing them to focus on the evidence and investigation rather than cultivating relationships with human sources.³⁵³

A sterile corridor has also been said to reduce the risks of corruption, misconduct and improper relationships between officers and human sources, because when handlers are separated from criminal investigations, they ‘do not have the same personal vested interest in the outcome of an investigation’.³⁵⁴

As discussed above, New South Wales Police does not use sterile corridors as it does not regard them as best practice. It nonetheless adopts an overriding principle of maintaining the anonymity and safety of human sources and seeks to manage these risks effectively through robust disclosure and other organisational procedures.³⁵⁵

Dr James told the Commission that while a sterile corridor is desirable, it is not always practical in smaller police services or where there are significant resourcing constraints.³⁵⁶

The Commission discussed Victoria Police’s use of a sterile corridor with participants at its focus groups, as outlined in Box 12.24.

Conclusions and recommendations

Victoria Police has taken significant steps to strengthen its human source management processes in recent years. While it has made progress, more work is needed to improve the current framework. The Commission considers that some features of Victoria Police’s human source management framework limit its capacity to manage human sources safely, ethically and effectively, including aspects of its policy requirements, decision-making model, organisational model, risk assessment processes, supervision practices and training.

The Commission also considers that Victoria Police does not adequately equip its officers with the knowledge to effectively identify and manage the risks of obtaining and disseminating confidential or privileged information from human sources. Perhaps most significantly, the Commission considers that an internal policy is not sufficient to govern Victoria Police’s use and management of human sources, nor to instil confidence in the Victorian community that it will do so in a way that is necessary, proportionate, ethical and compatible with human rights.

In a submission to the Commission, Victoria Police disagreed with these observations, suggesting that the evidence before the Commission should lead it to the conclusion that Victoria Police’s processes for managing human sources involving legal obligations of confidentiality or privilege ‘are likely to be the most stringent and effective of most (if not all) comparable jurisdictions’.³⁵⁸

The Commission accepts that Victoria Police’s processes for this specific category of human sources are more advanced than those operating in some other jurisdictions. This is in no doubt due to the events that led to the establishment of this Commission. Nonetheless, the Commission maintains that the current human source management framework needs improvement to assure the Victorian Government and the community that similar events will not occur in the future.

Without exception, law enforcement agencies consulted by the Commission emphasised the critical importance of human sources to the detection and prevention of serious crimes. Some noted that the use of human sources is becoming an increasingly valuable method of intelligence-gathering, as technological advancements and the growing sophistication of organised crime groups render other law enforcement techniques less reliable and effective.³⁵⁹

The Commission agrees that the use of human sources benefits policing, and ultimately, community safety. For all those benefits, however, it also carries considerable risks: to the rights of human sources and other people; to the integrity of Victoria Police and its officers; and to the administration of justice. As the events examined by this inquiry demonstrate, the right to a fair trial is particularly at risk when police use human sources involving legal obligations of confidentiality or privilege. But the use of all human sources poses risk, due in part to the covert nature of the activity and the significant discretion afforded to police in managing, tasking and rewarding them.

This Commission is not the first inquiry into Victoria Police’s use of human sources. Over 20 reviews in as many years have identified issues including deficiencies in policy and procedure, failures of supervision and management, non-compliance with policy requirements and improper conduct by some officers in their dealings with human sources. All of these factors point to the need for a clear and comprehensive regulatory framework that supports greater accountability and transparency in Victoria Police’s use of human sources.

The Commission recommends the introduction of legislation to govern the use and management of human sources, with specific safeguards for those who may provide or have access to confidential or privileged information. To support this legislation, it recommends a more effective and accountable internal decision-making model; clear, practical policy guidance; training at all levels of the organisation for officers involved in the management of human sources; regular and robust internal audit and monitoring; and an organisational model that enables Victoria Police to use human sources effectively and flexibly to meet its operational goals.

Design principles

The Commission has identified a set of key principles that it believes should guide the development of the proposed regulatory framework for Victoria Police’s use of human sources and related operational policies, processes and structures. As discussed in Chapter 13, these principles should also underpin the development of the external oversight model recommended by the Commission.

These principles are summarised in Box 12.25.

The Commission has drawn on the principles outlined in Box 12.25 in recommending a framework for Victoria Police’s future use and management of human sources. An overview of this framework is set out below.

Overview of the recommended framework

The Commission’s recommendations call for a robust, risk-based framework that supports accountability in decision making and supervision; comprehensive guidance for police officers with human source responsibilities; and careful scrutiny where there is a reasonable expectation that the registration and use of a source might result in the acquisition of confidential or privileged information.

Some of the Commission’s recommendations apply broadly to Victoria Police’s framework for all human sources, while others are specific to the use of human sources where confidential or privileged information may be obtained. This is necessary for system coherence and consistency. Limiting the broader recommendations to only those human sources with legal obligations of confidentiality or privilege would, in the Commission’s view, result in a disjointed, unbalanced and unnecessarily complex system in which other types of human sources are not subject to sufficiently robust processes and oversight.

The Commission is mindful of Victoria Police’s concern that ‘overly onerous requirements for registering or managing human sources could result in a reduction in Victoria Police’s capability to effectively gather and utilise criminal intelligence’ and that this, in turn, could have a negative impact on the Victorian community.³⁶⁰ The Commission’s recommendations aim to improve accountability and scrutiny of Victoria Police’s use of human sources, while also being practical and proportionate, and without compromising its ability to detect, disrupt and prevent criminal activity.

The Commission proposes that the human source management framework should be reformed by:

• developing legislation to regulate and publicly legitimise Victoria Police’s use of human sources and support it to manage them in accordance with the public interest
• clarifying and streamlining responsibilities for registering a human source, to increase accountability and efficiency in decision making
• requiring decision makers to consider necessity and proportionality and other key factors when determining whether to register a human source
• refocusing the issue of confidentiality and privilege on whether a human source is reasonably expected to have access to confidential or privileged information.

Further, the Commission proposes that these reforms should be supported by Victoria Police:

• aligning its Human Source Policy with the new legislative framework and ensuring that it provides clear, practical guidance and instruction to officers with human source management responsibilities
• adopting a dedicated and centralised human source management model
• increasing the delivery of human source management training to help officers identify and acquit their responsibilities under the recommended regulatory framework
• strengthening compliance, monitoring and governance functions to support robust internal oversight.

Figure 12.3 displays the Commission’s recommendations relevant to each part of the human source management process.

Figure 12.3: Overview of recommendations to strengthen Victoria Police’s human source management framework

• Phase 1—implementation of policy, training, internal audit and monitoring improvements, along with some limited changes to decision-making arrangements within 12 months
• Phase 2—implementation of the new legislative framework and new organisational model for the management of all human sources within two years.

The Commission considers that this approach will allow for adequate consultation, design and planning for the more significant legislative reforms and changes to organisational structures, while also enabling Victoria Police to introduce a series of policy, procedural and training improvements in the interim, some of which it has already taken steps to develop and implement.

Introducing legislation to govern the use and management of all human sources

There is no legislation governing the use of human sources in Victoria. This is at odds with requirements for the use of other covert powers and methods by police and means that the legal basis for the use of human sources is unclear.

While the Commission acknowledges that the use of Ms Gobbo as a human source was in many ways extraordinary, it was also a systemic failure—it continued for several years, even though a large number of police officers, including several senior officers, were aware of Ms Gobbo’s informing. Victoria Police has made many changes to its policy framework in response to these events, but, in the Commission’s view, the changes have not been enough to adequately manage the significant and enduring risks that arise in the use of human sources.

The very nature of human source management creates risks of improper conduct. This is relevant to all human sources, not just those who might have access to and provide confidential or privileged information. The need for police to form relationships with criminals or their associates can blur ethical and professional boundaries, sometimes to achieve operational goals (or ‘get the job done’). Tasking of human sources and issuing rewards to them can also involve police pushing ethical boundaries—whether by exploiting the source’s relationships with others, encouraging them to engage in deception, or facilitating their engagement in what would otherwise be criminal conduct.

This is not to say that the use of human sources is inherently wrong or unjustified, but rather that it occurs in a covert environment that is susceptible to ethical failure, misconduct and corruption, and requires a clear system of checks and balances to counter these risks. The Commission is not persuaded that the current internal policy adopted by Victoria Police achieves this. Nor is it convinced that a system of self-regulation of this necessary but high-risk area of policing could ever satisfactorily mitigate the risks, particularly the potential to compromise the criminal justice system and undermine the community’s confidence in it. In light of the events that led to the Commission, and what it has uncovered, there is more need than ever before to restore the community’s trust in Victoria Police and its management of human sources.

Except for the media coverage surrounding the use of Ms Gobbo as a human source, the related court decisions and this inquiry, there is very little publicly available information about how Victoria Police uses human sources. There are also no legislated, enforceable rules for when, why or how Victoria Police and its officers can engage in this activity.

In the United Kingdom, the introduction of a legislative framework aimed to establish a clear, lawful basis for the employment of investigatory powers, including the use of human sources, and to achieve an appropriate balance between protecting human rights and protecting community safety. The Commission heard that this framework gave law enforcement agencies more certainty about the use of and constraints on these powers, and helped to promote trust and confidence in the communities they serve.

Similarly, the introduction of legislation to regulate the use of surveillance devices, telecommunications interception, assumed identities, covert search warrants and controlled operations in Victoria and other Australian jurisdictions has increased accountability and transparency in the use and regulation of those powers and methods. The legislation also provides consistent frameworks able to withstand time and changes in senior leadership.

In her statement to the Commission, Ms Steendam indicated that Victoria Police was not advocating any legislative or regulatory reform but recognised that external oversight of its use of human sources would likely require legislative change. When addressing questions regarding external oversight, she expressed concerns about the potential for such a regime to apply to all human sources—rather than just those involving legal obligations of confidentiality or privilege—noting the risks to human sources should their identity become known.³⁶¹

The Commission did not receive evidence indicating that a legislative framework would inhibit Victoria Police’s ability to use human sources to detect and prevent criminal offences. Law enforcement agencies and other stakeholders from the United Kingdom who have operated under such a model for some time emphasised the positive effects and reassurance that the framework provides to agencies and their officers.

While the AFP expressed some concerns about the potential for Victorian legislation to limit interoperability across jurisdictions in the management of human sources, Ms Steendam, on behalf of Victoria Police, indicated that human sources are generally not managed across jurisdictions simultaneously. The Commission also heard that different frameworks and policy requirements appear to operate successfully across Australian police agencies now. For these reasons, it was not persuaded that a legislative framework would create significant inter-jurisdictional challenges.

The Commission anticipates Victoria Police may have concerns that introducing legislation will result in the use of human sources becoming more widely known in the community. There is an obvious and important need to protect the safety of human sources and the integrity of police investigative methods. The Commission considers, however, that establishing legislative requirements should not in and of itself compromise either the safety of human sources or covert policing methods, provided that the legislation is drafted carefully and in consultation with Victoria Police and other justice and legal profession stakeholders.

Having examined all of the evidence, the Commission considers that a legislative framework would lead to more effective management of the risks associated with Victoria Police’s use of human sources. Specifically, it would:

• support clear parameters and minimum standards for the use of human sources, consistent with the arrangements in place for other covert powers and methods
• ensure that any future expansion or amendment of these standards is subject to proper and public consideration by the Parliament
• improve transparency by building public awareness of the circumstances in which Victoria Police can use human sources and any limitations on such use
• provide assurance to human sources that Victoria Police will be held accountable for their management
• provide greater certainty to officers and support them to ensure that their decisions appropriately balance competing public interests.

In examining the United Kingdom legislative framework, the Commission considered the utility of introducing a code of practice in Victoria. A key purpose of the Code of Practice in the United Kingdom is to ensure consistency across hundreds of public authorities. In contrast, only a small number of Victorian agencies use human sources. Victoria also has a significantly smaller population than the United Kingdom. Further, the Commission considers that legislation and any associated regulations in Victoria could set out the types of requirements specified in the Code of Practice. Consequently, the Commission considers that it is unnecessary to introduce a code of practice in Victoria.

In the following sections, the Commission sets out the recommended:

• objectives and scope of the proposed legislation
• responsibilities for registration decisions under the legislative framework
• key considerations to underpin registration decisions.

Objective and scope of proposed human source management legislation

The proposed legislation needs to permit and facilitate the effective use of human sources to gather intelligence, conduct investigations and prevent, disrupt and detect criminal activity, while simultaneously ensuring that their use is ethical, necessary, proportionate and justified. The principal objective of the proposed legislation should be to appropriately balance these competing interests and provide a clear legal framework for police to use and manage human sources and the information they provide.

In the previous section, the Commission explained the need for such legislation to apply to all human sources used by Victoria Police, not just those in the narrow category of people with legal obligations of confidentiality or privilege. The Commission has also considered other aspects of the legislation’s scope; that is, which elements of Victoria Police’s use of human sources should be subject to legislative requirements; whether the requirements should differ depending on the type of source; and the potential implications of legislation for other Victorian agencies that use human sources. These are discussed below.

Registration, use and management of human sources

Typically, the risks associated with the use of a human source are considered and assessed at the point at which an officer seeks to register them as a source. These risks do not disappear, however, once the source is registered. Their ongoing management by police—which may include tasking the source to actively obtain information about criminal activity, requiring the source to put themselves in a precarious situation with criminal associates, or rewarding the source with cash or other benefits—also presents risks that need to be managed.

The importance of police maintaining an appropriate relationship with the human source over time underscores the need for the proposed legislative framework to cover the entirety of the human source’s relationship with police: from registration, through to ongoing use and management, to deactivation or transfer of the source to the role of a witness.

As noted earlier in this chapter, Victoria Police’s Human Source Policy requires officers to obtain authorisation before they can ‘approach’ certain human sources, separate and additional to that required for the (subsequent) registration of those sources. The Commission considers that this should not be within the scope of the proposed legislative framework. This issue is discussed later in this chapter.

The Commission also recognises there are issues associated with potential contact with, or risks to, a human source after they are deactivated. While the Commission did not examine these issues in detail during its inquiry, it notes that the very real risks to a human source’s safety do not cease simply because Victoria Police has ended its relationship with them.

As noted by several officers who participated in the Commission’s focus groups, the risk to a human source’s safety increases considerably if and when any information they provided to police is then relied on to arrest or charge the subject of that information. This may occur after the human source has been deactivated. These issues will be important to consider in developing the proposed regulatory framework, noting that this may be more appropriately dealt with in internal policy and procedures rather than in the proposed legislation.

Further, given the critical need to protect the identities and safety of human sources, the Commission recommends that the proposed legislation makes it an offence to disclose, without authority, information about a human source or information provided by a human source (including, in both cases, people who were formerly human sources). Section 36 of the Crimes (Controlled Operations) Act 2004 (Vic) may provide a suitable model for this offence.

'Reportable' and ‘non-reportable’ human sources

The Commission also considered whether there should be more stringent legislative requirements and safeguards for human sources involving legal obligations of confidentiality or privilege.

The Commission supports Victoria Police’s progress towards a policy framework that focuses on the nature of the information held or provided by a human source, rather than the occupation of the source. It agrees, as envisaged by the Human Source Policy, that more stringent safeguards should apply to the use and management of human sources who may provide confidential or privileged information, recognising the potential to jeopardise criminal prosecutions or convictions, impair a person’s right to a fair trial, compromise the integrity of the justice system and undermine professional relationships built on trust.

The Commission considers that the proposed legislation should create a category of human sources or prospective sources who are reasonably expected to have access to confidential or privileged information—hereafter referred to by the Commission as ‘reportable human sources’. For the avoidance of doubt, this includes prospective or registered human sources who are identified as already possessing confidential or privileged information, as well as those considered likely to access it in future. As discussed below, these reportable sources should be subject to certain requirements over and above those that apply to other human sources (‘non-reportable human sources’). The Commission considers that this approach would simplify the categorisation of human sources and processes for their registration.

Other potential reportable human sources

Victoria Police’s Human Source Policy lists other categories of human sources who may present higher risks or more complex issues, including those under the age of 18 years and those with a serious mental health or serious medical health condition. In the Commission’s view, there are clear ethical, welfare and human rights risks associated with the use of these individuals as human sources.

The Commission’s terms of reference did not extend to these types of human sources. Nor has the Commission had the opportunity to consult with all relevant stakeholders who have expertise and experience relevant to the specific issues and risks associated with the use of these sources.

Subject to consultation with these stakeholders, the Commission urges the Victorian Government to include people under 18 years of age or with serious mental or medical health conditions in the definition of ‘reportable human source’ under the proposed legislative framework. This would ensure that (like human sources who are reasonably expected to have access to confidential or privileged information), these sources are also subject to enhanced protections and safeguards.

One-off registrations

The Commission recognises that some risks that arise in the use of human sources on an ongoing basis do not apply in the case of one-off registrations; that is, prospective human sources who wish to provide information on a single occasion. For example, the risks of improper source–handler relationships could potentially be lower, because police cannot task one-off human sources and must not have an ongoing relationship with them. Some risks, however, apply to the use of all human sources, regardless of whether they provide information on a single occasion or multiple occasions—for example, the risk to a human source’s safety should it become known they have informed on their associates.

The Commission understands that Victoria Police has introduced a process for one-off registrations to provide more operational flexibility and efficiency. After giving careful thought to whether these one-off registrations should be within the scope of the proposed legislative framework, the Commission has concluded that this is necessary. Fundamental principles and requirements, like the need to consider human rights, necessity and proportionality, should apply to the use of all human sources, not just those used on an ongoing basis.

It may, however, be possible to tailor some aspects of the legislative and policy framework to facilitate more streamlined registration and risk assessment processes for one-off registrations, similar to those that currently exist under the Human Source Policy. This should be considered further by the Victorian Government in consultation with Victoria Police and other stakeholders about the proposed legislation.

Other Victorian agencies’ use of human sources

While other Victorian agencies such as IBAC also use human sources, the Commission’s inquiries were limited to Victoria Police because of its terms of reference and the Inquiries Act 2014 (Vic). As such, the Commission has confined its recommendations to Victoria Police’s use of human sources and has not consulted with other relevant agencies about their use of human sources.

Nonetheless, the Commission notes that the use of human sources by other agencies may well pose risks similar to those arising from Victoria Police’s use of sources. Consequently, while not formally recommending it, the Commission considers that there is merit in applying the legislative framework to all Victorian agencies that use human sources, subject to consultation with the affected agencies and an assessment of their current operations, policies and processes.

These recommendations and the other recommendations listed below are not intended to be exhaustive, but rather focus on key features of the proposed legislation—with a particular emphasis on safeguards for the use of human sources who may provide confidential or privileged information, and on other critical issues raised with the Commission during the inquiry.

Responsibility for registration decisions

The Commission considers Victoria Police’s current decision-making model for the registration of human sources is duplicative and inefficient, resulting in both a lack of clarity about roles and responsibilities and inadequate ownership of the decisions made.

Under the Human Source Policy, the Ethics Committee makes decisions about the registration of certain higher-risk human sources, dispersing accountability across a group of people. The CSR makes decisions about the registration of other human sources; though in practice, the registration of low and medium-risk human sources is delegated to a business unit, the HSMU. Under this model, registrations requiring Ethics Committee authorisation must proceed through five to seven review points before being considered. If an officer wishes to approach a person to ascertain whether they have useful information and could be registered as a human source, this request to ‘approach’ must proceed through these review points before Ethics Committee consideration, and the same multi-levelled process must be repeated if the officer wishes to then register the person as a source.

Several focus group participants pointed to delays in the authorisation of registration applications. Some also questioned the utility of LSRs and OICs reviewing applications, suggesting that many of these officers do not have the experience, time or training in human source management to actively interrogate applications. The Commission also considers that having so many officers involved in the review and decision-making process, without a clear articulation of the distinction between their roles and responsibilities, increases the risk that officers will not give applications the thorough and careful attention they deserve, on the assumption that others will take on this responsibility. It also increases the number of officers who are aware of the identity of a human source and therefore increases risks to their safety.

Further, the committee-based decision-making model for certain higher-risk human sources blurs accountability and unnecessarily delegates to a group of people a decision that could and should be made by an officer with appropriate seniority and experience.

Victoria Police disagreed with the Commission’s views on these matters. It explained that the committee-based decision-making model enables consideration of multiple perspectives, which is necessary for complex and difficult human source decisions.It also submitted that the Assistant Commissioner, ICSC is ultimately responsible for decisions made by the Ethics Committee.³⁶² Nothing in the Human Source Policy, however, makes this clear and no other evidence was produced to the Commission to confirm it.

The Commission recognises that, in making particularly complex human source decisions, a senior responsible officer may benefit from the views and experience of other officers and personnel, but considers that this would be better facilitated through an advisory group, rather than a committee making decisions that, according to Victoria Police, are ultimately the responsibility of the Assistant Commissioner, ICSC. Similarly, the Commission considers that, while workload pressures may warrant delegation of the CSR’s decision-making responsibilities, this delegation should be to a specific and sufficiently senior role, rather than to a business unit made up of multiple officers with varied levels of seniority and experience.

Having specific senior officers responsible for decisions, and making this clear in policy and procedures, would facilitate a shared understanding of roles and responsibilities, increase the transparency of decision making and encourage thorough consideration of registration applications. The Commission considers that it may also allow for more efficient and streamlined decision making.

The proposed authority for registration decisions under the Commission’s recommended legislative framework is outlined in Box 12.26.

In Chapter 13, and discussed below, the Commission recommends that, in the case of reportable human sources, the Chief Commissioner’s (or delegate’s) decision would need to take into account:

• formal legal advice relating to the proposed registration, including the likelihood and possible consequences of obtaining confidential or privileged information
• the recommendation of the PIM about the registration of the person as a human source.

Figure 12.4 below sets out how the recommended registration process would operate.

Under this process, the handler, controller and the HSMU would be required to critically assess the application and whether the person is a reportable human source, and outline their reasons for submitting, endorsing or not endorsing the application. The CSR would also have to undertake this process when submitting applications for the registration of reportable human sources to the Assistant Commissioner, ICSC.

Once made, the decisions of the CSR and the Assistant Commissioner, ICSC, along with their rationale for those decisions, should be communicated back to the handling team to provide them with a clear understanding about their assessment of the issues and risks involved.

While this process does involve multi-levelled review, the removal of the LSR and OIC roles from the decision-making model would reduce the number of review points. This aspect of the model is discussed further in the section below on ‘Victoria Police’s organisational model’.

Figure 12.4: Recommended registration process for human sources

The Commission acknowledges that the proposed arrangements for reportable human sources would increase the decision-making responsibilities of the Chief Commissioner or delegate (Assistant Commissioner or above), but given the small number of human sources likely to fall into this category, this is unlikely to have significant workload or resourcing implications.

The proposed model would also increase the decision-making responsibilities of the CSR, assuming that this officer is the delegate responsible for decisions about non-reportable human sources. This would likely have resourcing implications, given that the CSR currently delegates decisions about the registration of low-risk and medium-risk human sources to the HSMU.

The Commission considers that the precise resourcing arrangements are operational matters best left for Victoria Police to determine but suggests two potential options to manage the increased workload:

• the creation of an additional CSR position (or positions)
• enabling the CSR to sub-delegate their responsibility for certain registration decisions to a senior officer (for example, at the rank of Inspector or potentially Senior Sergeant).

Should Victoria Police consider that the second option is more feasible, the Commission considers that any such sub-delegation should be to a specific position, rather than to the HSMU as a unit—consistent with the objective of providing clear lines of accountability. Further, if this option were pursued, the Commission considers that Victoria Police should implement a functional separation between that position and other HSMU functions, to avoid any conflict of interest that might arise if the officer responsible for making a registration decision was to subsequently review that decision on behalf of the HSMU as part of the unit’s compliance monitoring functions.

Key considerations for registration decisions about all human sources

Just as there should be clarity about who is responsible for making decisions about the registration of human sources, so too must there be a clear set of criteria to guide those decisions.

Victoria Police’s Ethics Committee terms of reference set out the various factors it considers when making decisions about certain higher-risk human sources, including legal, ethical and human rights implications and the nature and imminence of the criminal conduct to which the human source information relates. The Commission believes that such considerations should extend to decisions about all human sources, not just those in specific categories.

Several stakeholders told the Commission that one of the strengths of the United Kingdom framework is its emphasis on necessity and proportionality in the use of investigatory powers, which provides a clear basis for decision making by public authorities. Similar principles and considerations should underpin the proposed legislative framework for Victoria Police’s use of human sources.

In determining whether to authorise the registration of any human source, the Commission recommends that the Chief Commissioner (or delegate) must be satisfied that the registration and use of a human source is appropriate and justified, including whether:

• the use of the prospective source is necessary and proportionate
• the risks associated with the prospective human source’s registration have been identified and can be adequately managed.

The Chief Commissioner (or delegate) should be assisted in making that determination by having regard to the following key considerations:

• the seriousness of the offence and imminence of the threat to which the information relates
• the likelihood of investigators being able to obtain the same information through other, less intrusive investigatory or intelligence methods
• the impact on the human rights of any individuals or the community if the person is used as a source and if information from them is utilised or not utilised
• legal advice or any other specialist advice obtained about the use of the person as a human source
• conditions that should apply to the AOR setting out the terms of Victoria Police’s relationship with the human source
• the specific purpose and length of time for the registration
• how the risk to the safety of the potential human source will be mitigated
• the adequacy of the risk assessment and other materials supporting the application.

These factors build on the matters currently considered by the Ethics Committee when making human source management decisions, and also draw on decision-making principles and factors outlined in legislation for other covert police powers and methods.

The Commission considered whether the proposed legislation or supporting regulatory or policy requirements should specify the duration of registration periods for certain categories of human sources, as exists under the United Kingdom’s Code of Practice. The Commission considers that it would be preferable for Victoria Police decision makers to have the flexibility and discretion to determine this on an individual basis, taking into account the purpose of the registration and the specific risks and circumstances involved.

Recognising the importance of ongoing risk management throughout the human source’s involvement with police, the Chief Commissioner (or delegate) should also have the power to impose conditions on registrations and determine how regularly the registration should be reviewed, informed by the specific risks and circumstances.

The requirement to set review periods recognises that the level of risk to or posed by a human source may increase or decrease over the course of their relationship with Victoria Police, requiring officers to adopt new mitigation strategies in response, or to deactivate the source if the registration is no longer appropriate. The subsequent review of a human source’s registration should require the Chief Commissioner (or delegate) to be satisfied the registration remains appropriate, taking into account the key considerations specified above, and that the identified risks are being or can be managed.

Establishing additional requirements for the registration of reportable human sources

The material the Commission examined did not warrant a complete prohibition on Victoria Police’s use of human sources involving legal obligations of confidentiality or privilege. As discussed in Chapter 4, a blanket ban would not eradicate the risk of confidential or privileged information being provided by a human source; nor would it equip officers with the skills to respond appropriately when this occurs. Additionally, the Commission recognises the possibility that, in rare cases, it may be legitimate and necessary to use human sources in occupations subject to legal obligations of confidentiality or privilege.

The Commission does consider, however, that the use of human sources who are reasonably expected to have access to confidential or privileged information should be treated with caution and subject to a clear and comprehensive system of checks and balances.

Victoria Police submitted that the current Human Source Policy casts a broader net over human sources involving legal obligations of confidentiality or privilege than other jurisdictions examined by the Commission, potentially going further than those jurisdictions. It noted that it is possible under the United Kingdom’s framework for a lawyer to be registered as a human source without engaging the enhanced registration process.³⁶³ The Commission acknowledges this, but notes that the United Kingdom framework would only permit this in circumstances where it is neither intended, nor likely, that the use of a lawyer as a human source would result in the acquisition of confidential or privileged information (in other words, where the information is clearly and entirely unrelated to the person’s occupation as a lawyer).

The Commission also accepts that Victoria Police has already taken steps to strengthen safeguards related to the use of human sources involving legal obligations of confidentiality or privilege. There is, however, scope to build on these measures by clarifying, formalising and embedding the safeguards within the recommended legislative framework.

In this section, the Commission sets out further requirements that it considers should apply to the registration and management of reportable human sources; specifically, requirements for:

• identifying and classifying reportable human sources
• obtaining and considering formal legal advice
• registering a reportable source, including where the intention is to obtain confidential or privileged information
• circumstances where there is a change in the scope of the registration
• emergency authorisations.

Identifying and classifying reportable human sources

As noted above, the Commission recommends that the proposed legislation should define a class of people who are reasonably expected to have access to confidential or privileged information, referred to in this chapter as reportable human sources.

Essentially, this means that the following people would be classified as reportable human sources:

• People currently or previously in an occupation that typically involves possession of or access to confidential or privileged information (such as lawyers, doctors, court officials, certain government workers and so forth), regardless of whether the information they are providing or offering to police is related to their occupation.
• People who are not in such an occupation, but appear to have access to information that might be confidential or privileged (for example, because it appears that the information originated from some type of professional relationship or context where a legal obligation to keep information confidential might apply).

The Commission considered the merits of a formulation similar to that adopted in the United Kingdom; that is, where the registration is likely or intended to result in a public authority’s acquisition of confidential or privileged material from a human source.

Ultimately, the Commission considers that it would be preferable to set a lower threshold, by focusing on whether a person is reasonably expected to have access to confidential or privileged information, rather than whether a person is reasonably expected to provide such information to police.

There are two, interrelated reasons for this:

• First, it can be very difficult to identify whether information is subject to a legal obligation of confidentiality or privilege. As noted in Chapter 4, this involves complex legal issues, and a determination about whether and to what extent an obligation applies typically relies heavily on the specific circumstances in which the information was shared or obtained. In the case of a prospective human source who is a lawyer, it will likely be easier for a police officer to identify that the person has access to confidential and privileged information (that is, because the person is a lawyer), than to determine whether the specific information being offered or provided is, in fact, confidential or privileged.
• Second, making the possession of or access to confidential or privileged information the determining factor in whether someone is a reportable source reduces the risk of officers, either deliberately or unknowingly, wrongly classifying a person as a non-reportable source.

The use of Ms Gobbo as a human source illustrates this point. In registering and using Ms Gobbo as a human source during her third registration in 2005–09, some Victoria Police officers suggested that the information she provided was not privileged (for example, because it was obtained in a social context, not in the course of providing legal services to her clients) and was therefore justifiable.

The difficulty is that, even where information held by a lawyer (or by another person subject to a legal obligation of confidentiality or privilege) appears to relate to a person’s personal associations, the question of whether the information is confidential or privileged may not be clear cut. Even if some of the information Ms Gobbo provided to police was obtained in a social context, the person disclosing it may have believed they were talking to her in her capacity as a lawyer, and their social discussions may have intermingled with discussions about legal advice.

Under the Commission’s recommended model, a lawyer in similar circumstances would automatically qualify as a reportable human source, because of their access to confidential and privileged information. They would therefore be subject to the more rigorous registration process proposed by the Commission.

While this approach will result in some prospective human sources being subject to a more rigorous registration process even though the information they hold may not ultimately be deemed confidential or privileged, the Commission considers it is justified because:

• it ensures that the decision about whether certain information is confidential or privileged sits with senior officers, informed by legal advice (discussed further below)
• even though this approach casts a broader net, the number of individuals expected to fall into the reportable human source category will still be very small
• it aligns substantially with Victoria Police’s current approach, whereby human sources involving legal obligations of confidentiality or privilege must be authorised by the Ethics Committee, irrespective of whether the information they hold is related to their occupation.

Exceptions to the duty of confidentiality or privilege

As noted in Chapter 4, there are exceptions to legal obligations of confidentiality and privilege. Of the exceptions, the most relevant to the duty of confidentiality are a waiver by the person to whom the obligation is owed and where legislation overrides the duty. The main exceptions to privilege are where it is waived or where the communications are made by the client to their lawyer or a third party in furtherance of the commission of a fraud or offence.

There is a risk that such exceptions could be used within Victoria Police to classify a prospective source as a non-reportable human source (that is, on the basis that the information is not confidential or privileged due to an exception), thereby avoiding the more rigorous registration process the Commission recommends for reportable sources.

Consequently, the Commission considers that the legislation should adopt a rule to the effect that, where there is a possibility that a prospective human source may fall within a recognised exception to a legal obligation of confidentiality or privilege, they should be treated as though they are a reportable source. This approach would ensure that decisions about whether information is subject to an exception are the responsibility of senior officers, informed by legal advice (as discussed below).

Formal legal advice to inform registration decisions about reportable human sources

As noted above, determining whether information is confidential or privileged is a difficult exercise that raises complex legal issues.

The Commission considers that Victoria Police’s processes for seeking legal advice to inform human source management decisions need to be formalised and strengthened. While there is a requirement for the Ethics Committee to consider legal advice when making its decisions, this is primarily through Victoria Police’s Executive Director of Legal Services, who is a member of the Committee and, since May 2020, has a vote in its decisions. In the Commission’s view, this is not an adequate substitute for formal legal advice.

Victoria Police told the Commission that there are established procedures for officers to obtain legal advice in relation to human sources, explaining that the HSMU often procures advice from Victoria Police’s Legal Services Department and the VGSO.³⁶⁴ There are, however, no explicit requirements or processes set out in the Human Source Policy for obtaining such advice.

The Commission considers that, under its recommended legislative framework, any proposed registration of a reportable human source must be informed by formal legal advice, and that this advice should be sought early in the registration process.

The Commission has considered whether Victoria Police should be required to seek legal advice from external independent lawyers in relation to the registration of reportable human sources, and notes Ms Steendam’s evidence that Victoria Police’s internal legal advisers are capable of giving ‘frank fearless and independent advice and appropriately meet their duty and their requirements as a legal practitioner’ and that Victoria Police engages the VGSO when needed.³⁶⁵ The Commission has also considered the fact that the recommended registration process will necessarily involve scrutiny of the legal advice obtained by senior Victoria Police decision makers and the PIM. Finally, the Commission notes that in Chapter 8, it has recommended that the Chief Commissioner takes steps to ensure that the role of Executive Director, Legal Services, provides independent legal advice.

The Commission considers that formal legal advice provided by Victoria Police’s Legal Services Department or the VGSO early in the registration process would act as an important safeguard, without the additional cost associated with obtaining legal advice from external lawyers, though Victoria Police could still seek external advice if and when it considered it necessary.

Registration of a reportable human source

Earlier in this chapter, the Commission recommended that the decision to register a reportable human source should be the responsibility of the Chief Commissioner or delegate of or above the rank of Assistant Commissioner. The Commission also considers that, for the reasons outlined above and in Chapter 13, the Chief Commissioner, in deciding whether to register a reportable human source, must have regard to formal legal advice and any recommendations made by the PIM before registering the person as a human source. They must also satisfy themselves of the key factors outlined earlier in the section, ‘Key considerations for registration decisions about all human sources’. In Chapter 13, the Commission makes recommendations about Victoria Police’s obligations to support the PIM’s role in these registration decisions and associated external oversight functions.

Registration of a reportable human source where it is intended to obtain or disseminate confidential or privileged information

In 2020, a new requirement was introduced to the Human Source Policy stating that, where Victoria Police intends to either obtain (that is, actively seek out) or disseminate confidential or privileged information from a human source, additional safeguards should apply; specifically, authorisation of the Deputy Commissioner, Specialist Operations.

The Commission considers that the proposed legislative framework should similarly impose enhanced safeguards in these circumstances, over and above those that apply to reportable human sources. This is because, rather than there being just a risk or a reasonable expectation that the use of a human source might result in obtaining confidential or privileged information, in this scenario there is an explicit intention to obtain or disseminate such information, which poses a greater risk of illegally or improperly obtaining evidence. In turn, this poses a heightened risk to the validity of criminal prosecutions or convictions and to the administration of justice more broadly.

In accordance with the test already envisaged by the Human Source Policy, the Commission considers that, under the proposed legislative framework, where Victoria Police wishes to register a person as a human source with a specific intent to obtain or disseminate confidential or privileged information, the Chief Commissioner or delegate of or above the rank of Assistant Commissioner must be satisfied not only that it is necessary and proportionate to do so, but also that there are exceptional and compelling circumstances to justify this course of action.

As with decisions to register reportable human sources, the decision maker must notify and consider the recommendation of the PIM (discussed further in Chapter 13). The PIM would apply the same test in forming a view about the registration; that is, whether there are exceptional and compelling circumstances to justify it.

The Commission considers that this test would only be met in circumstances where there is a serious threat to national security, the community, or the life and welfare of a person; and further, where the information is not able to be obtained through any other reasonable means.

The decision maker, as well as the PIM, would need to be satisfied that the public interest in averting such a serious threat outweighs the public interest in maintaining the confidentiality or privilege that attaches to the information. As with the decision to register a reportable human source, the Commission considers that this decision must be informed by formal legal advice provided by the Victoria Police Legal Services Department, the VGSO or external lawyers.

It is possible that any situation constituting exceptional and compelling circumstances would fall within an exception to the duty of confidentiality or privilege. The Commission nonetheless considers that the inclusion of an exceptional and compelling circumstances test in the legislative framework would provide clear guidance on the rare occasions where the intentional acquisition or dissemination of confidential or privileged information is permissible.

Changes in the scope of the registration

The risks of using a human source, their individual circumstances, and the nature of the information they provide or have access to may all change during their relationship with police.

It is possible that a human source originally assessed and registered as a non-reportable human source may subsequently fall into the category of a reportable human source—for example, after unexpectedly coming into possession of confidential or privileged information. In such cases, the Commission considers that any potentially confidential or privileged information provided should be quarantined so that it cannot be disseminated; the person’s registration should be cancelled (meaning they cannot be used as a human source) and a new application commenced to register the person as a reportable human source (if Victoria Police considers it necessary to continue using them as a source). In line with the registration process for reportable human sources recommended above, the Chief Commissioner (or delegate) would then be required to assess that new application, informed by legal advice and any recommendation of the PIM.

Similarly, there may be circumstances where a reportable human source has been registered with no expectation that they will provide confidential or privileged information but ends up doing so—for example, a lawyer who is registered on the basis that they are providing information about friends or relatives, but subsequently provides information about a client. As above, in these circumstances, the information should be quarantined so that it cannot be disseminated. As outlined in Chapter 13, the Commission also recommends that Victoria Police be required to report such instances to IBAC, which would have a role in monitoring Victoria Police’s compliance with the legislative and policy framework.

If, in either of these scenarios, Victoria Police wished to disseminate the confidential or privileged information, this would trigger the same requirements that apply to circumstances where there is an intention to register a person as a human source to obtain confidential or privileged information. That is, police would need to cancel the registration and commence a new application seeking the Chief Commissioner’s (or their delegate’s) authorisation, informed by legal advice and any recommendation of the PIM, on the basis that there are exceptional and compelling circumstances.

Emergency authorisations

The Commission recognises that there may be circumstances where there is a genuinely imminent threat to community safety or harm to a person, and Victoria Police must act promptly to counter that threat. Consequently, the Commission considers that the proposed legislation should include provisions enabling the Chief Commissioner to register a reportable human source without the involvement of the PIM in emergency situations.

The Commission considers that this would only be justifiable where there are exceptional and compelling circumstances (where there is a serious threat to national security, the community or the life and welfare of a person, and the information is not able to be obtained through any other reasonable means) and that threat is imminent.

This is broadly consistent with existing emergency authorisation provisions for the use of other covert powers and methods, such as those set out in the Surveillance Devices Act 1999 (Vic).

If Victoria Police were to make such an emergency authorisation, the Chief Commissioner should be required to provide the application materials to the PIM as soon as possible after registration, and the PIM should be able to examine the material and make recommendations as it considers necessary. This is addressed in more detail in Chapter 13.

Strengthening the decision-making model in advance of new legislation

As noted above, the Commission recommends a legislative framework under which the Chief Commissioner may register human sources or delegate that power to senior officers—of or above the rank of Assistant Commissioner in the case of reportable sources, and of or above the rank of Superintendent for non-reportable sources. A key benefit of this model is having a clear chain of command of individual officers accountable for the functioning of Victoria Police’s human source program.

The Commission considers that some of these benefits can be realised in advance of the proposed legislation through relatively straightforward interim amendments to the current decision-making model and associated requirements set out in the Human Source Policy.

The Commission recognises that Victoria Police recently adopted a new Human Source Policy that, among other things, reframed and expanded the categories of human sources whose registration requires Ethics Committee approval. The Commission also recognises that the introduction of new policies and processes involves substantial work to implement changes, update relevant guidance material, and communicate changes to officers. Thus, while recommending that certain new decision-making arrangements could be introduced in advance of the proposed legislation, the Commission is not recommending changes to the current categories of human sources set out in the Human Source Policy before the legislation is introduced. In this way, the Commission has sought to strike a balance between, on the one hand, remedying what it considers to be one of the most pressing issues in the current model; and on the other, ensuring that these remedies can be realistically achieved in the short-term, without creating unreasonable complexity and operational disruption for Victoria Police.

The Commission considers that the following changes could be introduced within 12 months, while the proposed new legislative framework is being developed, for the reasons outlined above:

• The Assistant Commissioner, ICSC (rather than the Ethics Committee) should be responsible for making decisions about the registration of Category 1–3 human sources and the dissemination of confidential or privileged information obtained from any human source, to establish clear accountability for determining these higher-risk matters.
• The CSR should be responsible for making decisions about the registration of human sources other than Category 1–3 human sources, which may require the appointment of an additional CSR or enabling the existing CSR to delegate certain decisions to an officer with appropriate seniority and experience.
• In making decisions about the registration of Category 1 human sources and any dissemination of confidential or privileged information, the Assistant Commissioner, ICSC should be required to consider formal legal advice provided by the Victoria Police Legal Services Department, the VGSO or external lawyers, and other specialist advice where required in the case of Category 2 and 3 human sources.
• Officers should not be required to seek approval through a multi-levelled process to ‘approach’ a prospective Category 1–3 human source and to subsequently follow the same process to register the source; however, the handling team should be required to seek advice from the HSMU before approaching such a person, and any subsequent registration application would require authorisation by the Assistant Commissioner, ICSC, as noted above. The Commission considers that, if there are robust processes in place for the registration of human sources and the dissemination of information they provide, a separate authorisation process for ‘approaching’ a prospective human source should not be necessary, and potentially pre-empts the matters to be considered and determined through the risk assessment and registration process.
• Category 4 human sources should no longer form a separate and standalone category of human sources. These are people who pose risks that would not normally permit their registration but for the fact that the information they hold is of ‘extraordinarily high value’. The Commission considers that this category is unnecessary and undermines the risk assessment and registration process. While there may be certain people who are not normally suitable for registration as a human source, the very purpose of a risk assessment is to assess the prospective source and their individual circumstances to determine the nature and value of the information they can provide, the risks and issues arising from their use as a human source, whether those issues can be managed, and ultimately, whether their registration and use can be justified. Rather than forming a special category of human sources, the Commission considers that these people should be subject to a risk assessment as with any other source, and registered if the decision maker (Assistant Commissioner, ICSC or CSR) deems their registration necessary and appropriate.

The Commission suggests that if Victoria Police wishes to preserve its Ethics Committee, the policy should remove any ambiguity about its role by making clear that its role is advisory rather than determinative.

Later in this chapter, the Commission recommends that the OIC and LSR should no longer form part of the human source management organisational model, including decision-making and supervision processes. The Commission considers that this change should be implemented as part of broader organisational changes simultaneously with the introduction of the legislative framework, given that this would represent a more substantial change to the existing model.

Improving the Human Source Policy

Victoria Police has made substantial efforts to improve and strengthen its Human Source Policy, most notably through amendments introduced in 2014, 2015, 2016 and 2018 in response to the Comrie Review and Kellam Report, and in May 2020, to incorporate additional measures designed to, among other things, manage the risks of obtaining and using confidential or privileged information from human sources.

Despite these efforts, the Commission considers that Victoria Police’s Human Source Policy needs further improvement; in particular, to:

• set out clear principles and objectives to guide and inform officers about why the lawful and ethical management of human sources is important and necessary
• support officers’ understanding of the interaction between human rights and human source management, and how to meet their obligations under the Charter
• provide additional guidance about legal obligations of confidentiality or privilege, the potential consequences of obtaining confidential or privileged information from a human source, and how such information should be used, handled and disseminated
• clarify and strengthen requirements relating to the AOR and sterile corridor.

These are discussed below.

Principles and objectives for the use and management of human sources

Human sources are individuals—consequently, they present unique motivations, behaviours, benefits and risks. It is not possible to prescribe rules for every potential scenario. Rather, processes must be sufficiently flexible to enable police to exercise appropriate discretion, and underpinned by clear principles and objectives to guide police decisions and actions in various situations and contexts.

The Commission considers that the Human Source Policy currently lacks these principles and objectives. For example, the policy refers briefly to the principles of necessity and proportionality, without articulating the factors to be considered by police officers in assessing whether the use of a human source is necessary and proportionate. It refers to certain types of people whose risks would ‘not normally permit registration’ but for the fact that the information they have is of ‘extraordinarily high value’—without explaining either of these terms or how officers should weigh up the competing risks and benefits. The policy mandates that supervising officers practise ‘intrusive supervision’ of the handler–source relationship but does not explain the purpose of supervision or why it is important.

In focus groups with the Commission, some participants observed that Victoria Police does not have a clear policy or strategic position on the use of human sources, their value to the organisation and whether their use should be increased or discouraged. Many participants demonstrated awareness of recent procedural changes; however, some either could not articulate the purpose of these changes or regarded them as reactive responses to recent reviews or the Commission’s inquiry, rather than thoughtful, evidence-based changes to improve the human source management framework.

The lack of appropriate guidance in the Human Source Policy, combined with a perceived lack of clear communication about why certain decisions are made, has contributed to varied views among officers about when human sources should and should not be used and why. Handlers and controllers in the Commission’s focus groups consistently expressed the view that decisions by senior officers about the registration of certain higher-risk sources are driven purely by the avoidance of reputational risk to Victoria Police, and that this is at the expense of detecting and preventing serious crime. In contrast, senior officers and decision makers repeatedly emphasised that registration decisions always weigh up competing public interests, and that certain higher-risk prospective sources are typically not registered because it is not in the public interest to do so.

Victoria Police needs to address this issue. It must do more than set out technical procedures in its Human Source Policy and expect unquestioning compliance among its officers. An effective policy framework requires coherent principles that encourage a shared understanding of the organisation’s expectations for the proper and ethical use of human sources. If officers do not respect and understand the basis of decisions and are not guided to consider and balance the relevant public interests themselves, there is a significant risk that their use and management of human sources will fall short of the standards now expected by Victoria Police.

The legislation recommended by the Commission would establish a publicly accessible and transparent framework for the regulation of the use and management of human sources, but it would not displace the need for internal policies and procedures. Rather, the Human Source Policy should complement and expand upon legislative requirements and provide officers with practical instruction and guidance about why these requirements exist and how to satisfy them.

The Commission considers that Victoria Police should undertake work to clearly set out the principles and objectives of its human source management program in the Human Source Policy, and that it should do so within 12 months, rather than waiting until the new legislation commences operation. Some of the Commission’s suggestions about the legislation’s objectives could usefully inform the development of this policy guidance.

The Commission also urges Victoria Police to adopt a careful and considered approach to this work, recognising that, as noted in Chapter 11, previous changes to the Human Source Policy have at times contributed to greater complexity and uncertainty for officers.

A human rights-based approach in the use of human sources

The Commission found that Victoria Police’s current policy framework for human source management does not provide officers with adequate guidance to uphold their obligations under the Charter. A focus on human rights should underpin the entire period for which a human source is used and managed.

The strong emphasis on human rights in the United Kingdom’s framework, equally appropriate in Victoria given the Charter, puts necessity and proportionality at the forefront of police considerations of, and decisions about, the use of human sources. Several stakeholders told the Commission this emphasis also helps to engender community support for policing activities. The Commission considers that it is likely to result in more, not fewer, suitable individuals being prepared to become human sources.

The Commission is of the view that the Human Source Policy could be more instructive about how human rights are engaged, and how and whether they can be lawfully limited, through the use of human sources. This includes the right to a fair trial. One way to improve the policy would be to include hypothetical examples or scenarios that are relevant to the human source context. The Human Source Policy should also refer officers to the general guidance already provided within the Victoria Police Manual Policy Rules—Human rights equity and diversity standards.

Victoria Police has acknowledged it could do more to provide guidance to officers about how to apply human rights in practice. It submitted that this is the case across its broader operations, not just human source management, and noted that consistent with its ‘focus on ethical leadership, human rights will be a priority in training and policy development moving forwards’.³⁶⁶ The Commission supports Victoria Police in these endeavours, including through the incorporation of additional human rights guidance in the Human Source Policy.

The Commission also makes recommendations to foster a greater focus on human rights in Victoria Police’s risk assessment process and human source management training later in this section.

Guidance about confidential and privileged information

The Commission’s focus groups with Victoria Police officers suggested that ambiguous policy and insufficient guidance have contributed to a lack of certainty and understanding among many officers about legal obligations of confidentiality and privilege. Without such an understanding, it is difficult for officers to fully appreciate the risks of obtaining and using confidential and privileged information, to identify where these risks might exist and seek appropriate advice, and to manage them carefully and in accordance with the policy requirements.

As outlined in Chapter 4, there can be considerable complexities in identifying what is confidential or privileged information and anticipating circumstances when it may be provided. Given the risks to investigations, prosecutions and possibly convictions that may flow from the disclosure or use of such information, it is critical that the human source management framework provides clear guidance to assist officers with this task. Such guidance should be buttressed by legal advice, discussed above, and comprehensive training, discussed below. The Commission considers that the policy needs to place greater emphasis on whether the information held by a prospective human source originated from a professional relationship and could create a conflict of interest for the source, as well as providing advice on the occupations in which legal obligations of confidentiality or privilege commonly arise. In making these changes, Victoria Police should seek advice from its Legal Services Department or the VGSO.

In addition to providing more guidance about when issues of confidentiality and privilege may arise, the Commission considers that police officers need clearer guidance about how to appropriately use, handle and disseminate confidential and privileged information.

The Commission notes that Victoria Police may also acquire confidential or privileged information through its other covert methods. While the Commission has not examined the processes for handling such information in detail, it may be beneficial for Victoria Police to consider aligning these processes with those recommended by the Commission, to ensure that there is a clear and consistent approach to managing confidential or privileged information across the organisation.

Acknowledgement of Responsibilities

The Commission appreciates most human sources managed by Victoria Police do not have legal obligations of confidentiality or privilege. On the rare occasions that police do register such a source, the Commission considers that the AOR should clearly state that the source is not to provide confidential or privileged information (unless specifically authorised to do so, under the registration process outlined above, where it is intended to obtain and disseminate such information). The Commission heard that, in practice, the Ethics Committee would insist on setting this out in the AOR. Specifying this as a requirement in the Human Source Policy would help to ensure that it occurs in practice and that all officers dealing with human sources understand what must occur.

Further, as outlined in Chapter 11, while the Human Source Policy previously included a requirement that officers must not actively seek information from a human source that would cause the human source to breach a professional obligation—a requirement included in response to the Comrie Review and Kellam Report—this was removed from the most recent version of the policy. The Commission considers that, for the avoidance of doubt, the Human Source Policy should clearly state that officers are not to do this (again, unless specifically authorised under the registration process outlined above).

Handling a human source within a sterile corridor

Victoria Police’s Human Source Policy explains that human sources should be managed in a full or partial sterile corridor, and high-risk sources must be managed in a full or partial sterile corridor ‘to ensure the safety of the human source is not compromised in order to achieve investigative outcomes’. It follows that if a full sterile corridor is not in place, or not feasible, there are obvious risks that need to be managed.

The Commission acknowledges the sterile corridor may be difficult to strictly apply in practice, particularly under Victoria Police’s current model. It also recognises that any policy needs to be flexible enough to accommodate operational requirements; however, the Human Source Policy does not provide clear guidance on when the lack of a sterile corridor is permitted and why. Nor does it provide any guidance on how to manage the risks associated with a partial, or absent, sterile corridor. This creates the potential for inconsistent practice across Victoria Police and may compromise the safety and wellbeing of human sources if not managed appropriately.

Later in this chapter the Commission recommends a dedicated and centralised human source management model, which, if adopted, should go part of the way to addressing this risk. As this model may not be implemented for some time, the Commission considers that Victoria Police should take steps now to include clear guidance in the Human Source Policy on the requirement for a sterile corridor and when it may be appropriate not to adhere to this requirement.

Chapter 14 addresses Victoria Police’s efforts to manage disclosure issues arising from the sterile corridor approach.

Strengthening Victoria Police’s capability and capacity

In this section, the Commission considers Victoria Police’s capability and capacity to manage human sources, taking into account the Commission’s recommendations to introduce a new legislative framework and to strengthen the Human Source Policy.

Victoria Police’s organisational model

The Commission appreciates that Victoria Police’s current hybrid model for human source management provides flexibility for Regional Divisions to manage and allocate resources in response to operational needs.

Notwithstanding these benefits, there are significant limitations in the model and its ability to ensure the robust and ethical management of all human sources across Victoria. For example, the model increases the risk of poorly managed conflicts of interest, by allowing regional officers to manage sources directly linked to their investigations, contrary to the preference for a sterile corridor outlined in the Human Source Policy. It also creates an environment where some police officers manage human sources infrequently, sometimes years after having completed human source management training, reducing the likelihood of them understanding and adhering to current policy requirements.

In a submission to the Commission, Victoria Police acknowledged the limitations of the hybrid model, noting that the multi-level registration process could be simplified in a more centralised model, but also noted that the current process is necessary so that LSRs are sufficiently appraised of and able to effectively supervise operational activity in their local areas or units.³⁶⁷

Evidence before the Commission indicated not all police officers responsible for human source management are subject to rigorous supervision and management, in part due to supervising officers having no experience or specialised skills in this area. The hybrid human source management model makes it difficult for OICs and LSRs, in particular, to balance their human source management roles with a much broader set of operational and managerial responsibilities.

A centralised and dedicated human source management model means that human sources would only be handled by DSTs that report directly to centralised management. This would increase Victoria Police’s ability to ensure that all officers involved in human source management have the appropriate skills, training and experience to identify and manage the associated risks.

The Commission acknowledges Victoria Police may be concerned that removing OICs and LSRs from the human source management organisational model could diminish oversight of human source management in the regions. Victoria Police may wish to consult with Western Australia Police, noting it has successfully implemented a centralised model even though it is responsible for the largest geographic state in Australia. By contrast, Victoria is the second most populous state, but the second smallest in geographic area, which should be an advantage in implementing a centralised model.

Victoria Police’s Executive Command has given in-principle support to a more centralised and dedicated human source management model and the Commission supports this approach. While this would likely require an increase in resources allocated to human source management—along with work to attract and train police officers with the suitable attributes, particularly those to be based in regional areas—such a model would reflect both the importance of and the high level of risk associated with this function. It would also support the development of a specialised workforce capable of managing the particular challenges that arise in the use of human sources, including issues related to confidentiality and privilege. It is important, however, that any such model delivers services across Victoria and not solely in metropolitan areas, ensuring that the entire state benefits from Victoria Police’s investigative powers and methods.

The decision-making arrangements recommended in the preceding sections would be complemented by a centralised model, with a clear hierarchical management structure and designated responsibility for decision making. It would also provide Victoria Police with the opportunity to select officers with the appropriate skills, attributes and experience for human source management roles.

The Commission acknowledges that DSTs can pose an increased risk of police misconduct and corruption; for example, through handlers developing personal or otherwise inappropriate relationships with human sources over long periods of time. The Commission considers that this risk could be effectively managed through reasonable maximum time in position requirements, regular rotation of handlers and controllers of long-term human sources, and appropriate misconduct prevention strategies.

The Commission recognises Victoria Police already rotates officers through certain dedicated human source management roles and considers that these existing requirements should be applied and extended across all dedicated roles.

Risk assessment

A robust approach to the identification, assessment and mitigation of risk is essential for Victoria Police to manage human sources ethically and effectively.

Central to the decision to register a human source is the issue of whether the risks of their use can be appropriately and adequately mitigated; that is, reduced to an acceptable level. This assessment needs to be repeated regularly through the period of registration, so that any escalation in risk is identified and additional risk mitigation strategies put in place.

Initial risk assessments must consider all relevant factors for the engagement of a person as a human source, including whether their use as a source engages any human rights and is necessary and proportionate. They must provide decision makers with sufficient information to assess the nature and value of the information against the risks of using the person as a source and whether the decision to register a prospective source is justified and in the public interest. To do this, risk assessments must also include contrary information that could result in the rejection of the application, as is the case with similar covert intelligence and investigative methods.

The Commission has identified, and Victoria Police acknowledged, limitations with its current Initial Risk Assessment. One of these limitations is that it does not specifically prompt officers to consider if information to be provided by a human source is, or may be, confidential or privileged. The Initial Risk Assessment could better highlight the importance of considering the origin and nature of information to accurately assess risk.

Most participants in the Commission’s focus groups expressed the view that the Initial Risk Assessment is unnecessarily cumbersome and not fit for purpose. These shortcomings give rise to some serious risks:

• creating a perverse incentive for officers to operate outside the process by using unregistered human sources
• deterring officers from using human sources (and potentially limiting opportunities to detect and prevent serious crime)
• causing officers to see the risk assessment as a meaningless exercise that is necessary only for compliance with the policy.

The Commission notes Victoria Police is reviewing its Initial Risk Assessment tool, and that the review is likely to streamline the assessment while also taking into account the issues identified as part of this inquiry.

The Commission acknowledges Victoria Police has recently implemented the One-off Risk Assessment for human sources providing information to Victoria Police on a single occasion and the Dynamic Risk Assessment, which is designed to assess changes in risk throughout the period of a source’s registration. Both assessments prompt officers to consider confidential and privileged information.

Victoria Police’s human source management risk assessments would benefit from explicit inclusion of fields that require officers to consider human rights and the necessity and proportionality of using the source. Documenting and providing reasoned analysis of human rights in human source risk assessments would assist officers to fulfil their obligations under the Charter and determine whether registration of a prospective human source is justified.

Additionally, Victoria Police should amend its risk assessments to prompt officers to consider the risks that the use of a human source could pose to the proper administration of justice. The Commission considers this would be best achieved by including additional questions and guidance within the category of ‘risk to the information or investigation’.

The work undertaken by Victoria Police to improve and strengthen its risk assessments is a positive step. To ensure that these changes are effective, the Commission recommends that Victoria Police engages an external expert to undertake a thorough evaluation of the revised tools after implementation.

Supervision of the human source–handling team relationship

Active supervision and support of handlers and controllers is critical to the appropriate and ethical management of human sources.

While the Human Source Policy instructs all supervisors to exercise ‘intrusive supervision’, the Commission found the practical application of it is at best variable and often poor among some LSRs and OICs. Consistent and thorough supervision is best achieved when the people responsible have adequate time to do so rather than when they are trying to balance multiple, and often competing, operational priorities.

For these reasons and in line with the Commission’s recommendations for Victoria Police to adopt a dedicated and centralised model without the OIC and LSR roles, the Commission considers the supervision of handlers and controllers is best suited to the dedicated roles of the HSMU and the CSR.

It is not appropriate for senior officers to regard handlers and controllers as ‘experts’ who do not require close scrutiny, as demonstrated in Victoria Police’s management of Ms Gobbo. The Commission observed during its focus groups that this perception still has currency among some officers with supervisory functions. The risks associated with the use of human sources are such that, no matter how experienced a handler or controller may be, there should always be consistent and rigorous monitoring and oversight of the source’s management and the relationship between the source and the handling team.

The Commission considers that the Human Source Policy does not contain sufficient guidance for officers about why supervision is necessary and important, who is responsible for it and how they must acquit those responsibilities. It also conflates the processes of supervision and compliance monitoring (for example, reviewing files to ensure compliance with timeframes and other policy requirements). Supervision should go further than monitoring compliance and include active discussion with the handling team about how to manage the human source, testing and challenging their approach, and assisting them to identify and maintain strategies to manage risks.

Human source management training

As outlined earlier in this chapter, all police officers involved in human source management are required to complete the basic online training course, and handlers and controllers of certain types of sources must complete a higher level of training.

The Commission found that until recently, Victoria Police’s human source management training courses have not addressed the risks associated with obtaining and using confidential and privileged information, nor the significance of human rights in determining whether the use and management of a human source is justified in all circumstances. This was evident in the confusion among some focus group participants about when these obligations may exist; although officers who had completed intermediate and specialised training generally had a stronger understanding of these concepts. The Commission’s proposed reforms to the Human Source Policy would assist in building officers’ understanding of confidentiality and privilege and human rights. This should be supported by comprehensive training on these issues.

During the Commission’s inquiry, Victoria Police made amendments to training and delivered tailored training courses, including a session on privilege and disclosure for some officers. It also updated the basic online training course to align with the Human Source Policy introduced in 2020 and include content on legal obligations of confidentiality or privilege and human rights.

Notwithstanding these improvements, the Commission has reviewed Victoria Police’s basic online training and considers that it is unsuitable as a minimum requirement for those with direct responsibility for human source management. It heard that the training may not equip officers with adequate practical skills to manage a human source or to fully understand their obligations under the Human Source Policy. The Commission therefore considers that basic online training should only be used to provide officers who are not in human source management roles with an understanding of general requirements for the management of human sources, and to assist them to identify issues for escalation to the HSMU (including issues of confidentiality or privilege).

In a submission, Victoria Police disagreed with the Commission’s views. It cautioned that, while it is receptive to conducting additional face-to-face training, this requires significant resourcing, particularly when officers may not be ‘particularly active in performing human source management activities’.³⁶⁸

While noting Victoria Police’s response, the Commission maintains that face-to-face training is necessary for officers who are responsible for managing human sources, or overseeing the handler–human source relationship. This would provide assurance that these officers have been sufficiently trained in, and understand, their responsibilities and how to identify and manage any risks. The Commission’s recommendation for Victoria Police to adopt a centralised and dedicated organisational model may reduce the number of officers able to manage human sources and therefore the number of officers requiring face-to-face training.

The Commission also considered whether the lack of specific training requirements for HSMU officers, the CSR and Assistant Commissioner, ICSC is appropriate. The Commission accepts Victoria Police’s view that because these officers are responsible for risk mitigation, supervision and governance rather than engaging with and managing human sources, the current training courses may not be necessary requirements for these roles.

They must, however, receive training that assists them to effectively supervise handling teams and to identify and manage the risks that commonly arise in human source management, including risks of non-compliance with policy requirements, risks of unethical or improper conduct and risks related to confidential and privileged information.

The Commission also considered the current lack of ongoing or ‘refresher’ training for officers involved in human source management. Many participants in the Commission’s focus groups suggested that human source management skills are perishable—they need to be reinforced and strengthened over time. The current lack of ongoing training and professional development relating to human source management means that there are Victoria Police officers handling sources who may not have completed any training for many years. The Commission considers that ongoing training is necessary to update officers’ knowledge and understanding of policy requirements and to reinforce and build on their existing skills to effectively manage human sources and the associated risks.

While human source management training is expensive, Victoria Police must ensure its officers are appropriately equipped for their roles.

Should Victoria Police adopt a dedicated and centralised human source management model in line with the Commission’s recommendations, it is likely that fewer officers would be involved in human source management across the organisation. Further, those who are involved in this work would be in dedicated roles; that is, focused only on human source management functions and responsibilities. This would enable training resources to be allocated in a more cost-effective way, with more intensive training, and ongoing training, delivered only to those officers who need it to undertake these roles.

Information and communication technology system capability

Victoria Police has improved its information and communication technology systems over recent years, including enhancing Interpose to manage risks associated with human sources and the information they provide.

The Commission accepts that Interpose is limited in its capacity to provide a wholesale remedy to these risks. While a dedicated human source management system could undoubtedly bring benefits, the costs of such a system and the timeframe for its implementation are unknown.

While recent improvements to Interpose have increased the capability of police officers to identify, understand and manage issues relating to legal obligations of confidentiality or privilege, the Interpose system still has limitations. In particular, as discussed in Chapter 10, there is currently no field to capture whether information may be confidential or privileged and no simple automated way to search for human sources or information that may be subject to legal obligations of confidentiality or privilege. It is likely that these limitations impede effective audit and monitoring of the human source management program. The Commission encountered several challenges when undertaking its audit of human source files and seeking to obtain other human source information and data from Victoria Police.

The Commission considers that Interpose would be enhanced by the ability to record the origin of information provided by human sources and identify information that may be confidential or privileged.

While the Commission has not undertaken a detailed review of the functionality of Interpose, it notes that significant policy and operational changes will flow from its recommendations. Therefore, the Commission considers that Victoria Police should ensure Interpose has the necessary functionality to support robust and secure record-keeping for its human source management program and the effective implementation of the Commission’s recommendations. It also suggests that, if Interpose cannot be enhanced to do this, Victoria Police should ensure that the required functionality is built into the new case management system under consideration by Victoria Police.

Internal audit and monitoring of compliance

Victoria Police has strengthened mechanisms for internal audit and monitoring of the human source program in recent years. The routine audits undertaken by CaRMU appear to have appropriate scope and frequency, covering a broad range of human source related activities. Further, the functional separation of CaRMU from the human source management program supports a rigorous and objective approach.

As CaRMU’s audits are predominantly focused on high-risk sources, there is a risk that low and medium-risk human sources may not be subject to adequate monitoring. Risk is fluid and subject to change—a low-risk source can quickly become a high-risk source due to a change in life or other circumstances. Further, improper or non-compliant management of a low or medium-risk source could potentially have consequences that are as severe as the consequences of inadequate management of a high-risk source.

There is also a possibility that officers may erroneously categorise a high-risk source as low or medium risk, or fail to identify all relevant risks. The Commission considers that expanding the reach of CaRMU’s audits to low and medium-risk sources is necessary to provide assurance that risks across the entirety of Victoria Police’s human source management program are being managed effectively. This may also address concerns noted by some focus group participants that the current audit program has a disproportionate focus on areas with already high rates of compliance.

In a submission, Victoria Police explained that CaRMU’s audits focus on high-risk human sources because the consequences of non-compliance with the Human Source Policy for these sources are likely to be magnified; however, ‘there are automated audit processes in Interpose, which are monitored by the HSMU, that apply to all human source registrations’.³⁶⁹

The Commission suggests that the Institute of Internal Auditors’ ‘three lines of defence’ model provides a useful way of looking at arrangements for managing the risks that arise from Victoria Police’s human source program. Under that model, ‘management control is the first line of [defence] in risk management, the various risk control and compliance oversight functions established by management are the second line of [defence], and independent assurance is the third.’³⁷⁰ The model provides ‘a simple and effective way to enhance communications on risk management and control by clarifying essential roles and duties’ in an organisation.³⁷¹ Looking at the current arrangements in Victoria Police, the HSMU’s role is a hybrid of the first and second lines of defence, CaRMU is in the second line of defence and Professional Standards Command and Internal Audit constitute the third line of defence.

While acknowledging the HSMU’s audit activities, for the reasons above, the Commission considers that it would be preferable to extend CaRMU’s audit program to low and medium-risk human source registrations. The Commission also considers that it would be beneficial for Victoria Police to specify an ongoing program of CaRMU audits within its Human Source Policy so that officers involved in human source management have a clear understanding of the organisation’s requirements for internal audit and monitoring of the human source program.

The Human Source Policy outlines the responsibilities of the HSMU for reviews, audits and compliance reporting. The Commission observed that the HSMU performs a critical role in the day-to-day monitoring of compliance with the Human Source Policy by conducting reviews, undertaking quality assurance and providing specialist advice to handling teams.

The importance of the HSMU’s role was consistently recognised by focus group participants, who spoke about the substantial assistance, expert advice and support provided by the unit. The Commission noted, however, that the dual role of the HSMU undertaking compliance reviews and making decisions about registration of certain sources has the potential to create conflicts of interest.

Victoria Police told the Commission that while ‘the HSMU provides advice to members of the handling team, the advice is generally based on ensuring compliance’ with the Human Source Policy, and the CSR has a key role both in overseeing the HSMU and retaining overall authority on all human source governance functions.³⁷²

The Commission considers that CaRMU’s auditing role assists in managing these potential conflicts, and that the Commission’s recommendations earlier in this chapter to restrict registration decisions to individual senior officers would also help to address this risk.

In addition to clearly setting out the audit and compliance monitoring functions of the HSMU and CaRMU in the Human Source Policy, the Commission considers that it would also be beneficial to distinguish between the role of senior officers to directly supervise the management of a human source and monitor the handling team’s compliance with policy requirements, and the broader audit and compliance monitoring roles of HSMU and CaRMU in providing assurance across the whole human source management program.

Victoria Police would also benefit from a formalised regime for regular reporting on these audits to the Assistant Commissioner, ICSC to ensure executive oversight of any issues identified. There should also be additional reporting processes for any system-wide risks identified or major failings involving the use of human sources to the Audit and Risk Committee. This would assist with implementing a risk-based approach to human source management and better ensure Victoria Police Executive Command is appropriately informed of relevant issues so that they can be acted upon.

Should the Commission’s recommendations in Chapter 13 be adopted, IBAC would also have a role in monitoring Victoria Police’s compliance with its legislative and policy obligations relevant to human source management. This, together with the recommended measures below, would result in an internal audit and compliance program delivered by HSMU and CaRMU and overseen by the Assistant Commissioner, ICSC forming ‘the first two lines of defence’. The additional safeguards provided by the other aspects of the Commission’s proposed external oversight framework would create what is sometimes referred to as the ‘fourth line of defence’ in risk management.³⁷³

Strategic oversight of the human source function

Victoria Police has made efforts to strengthen governance of its human source program over recent years, with systems in place for increased internal oversight and reporting on higher-risk matters. The Commission’s recommendation to reallocate the Ethics Committee’s decision-making role to the Assistant Commissioner, ICSC presents an opportunity to reconsider Victoria Police’s governance arrangements for its human source management program.

In Chapter 11, the Commission recommends that alongside Victoria Police’s Capability Plan 2016–2025, Victoria Police should establish clear processes for the review and management of human source management policies and procedures. To complement this work, the Commission considers there would be benefits in Victoria Police establishing an internal governance body to oversee implementation of the significant reforms recommended by the Commission and support effective change management across the organisation.

The Commission also considers that this internal body could perform an ongoing governance and advisory role, focused on identifying and examining emerging strategic risks and issues related to Victoria Police’s human source program, and providing strategic advice to the Assistant Commissioner, ICSC and Deputy Commissioner, Specialist Operations.

Funding and implementation

Victoria Police told the Commission that further changes to Victoria Police’s human source management program, such as a move to a dedicated human source management model, would require additional resourcing. While that may be the case, the Commission also notes human source management already receives ongoing funding and resourcing as it is part of Victoria Police’s current operational framework.

Endnotes

_{1 The Commission acknowledges that all human sources, by their very nature, provide information that others expect them to keep secret and not disclose to the police and/or other people. This is different to information that is confidential because of a legal obligation associated with a professional relationship or because of a person’s occupation.}

_{2 Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, 71 [11.8].}

_{3 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020. This policy is dated 15 April 2020 but came into effect on 4 May 2020.}

_{4 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 2.}

_{5 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 1.}

_{6 Exhibit RC1532b Victoria Police, Covert Services Division, Intelligence & Covert Support Command, Human Source Strategy 2018–2022 (draft v7): A Better Way to Manage Risk, Undated, 5.}

_{7 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 1, 17 [4.5], 43 [21]–[22].}

_{8 Charter of Human Rights and Responsibilities Act 2006 (Vic) s 4.}

_{9 Charter of Human Rights and Responsibilities Act 2006 (Vic) s 1(1), pt 2. The human rights set out in the Charter are drawn primarily from the International Convention of Civil and Political Rights, opened for signature 16 December 1966, ATS 23 (entered into force 23 March 1976).}

_{10 ‘Human Rights’, Victorian Equal Opportunity and Human Rights Commission (Web Page) .}

_{11 Charter of Human Rights and Responsibilities Act 2006 (Vic) s 7(2).}

_{12 Charter of Human Rights and Responsibilities Act 2006 (Vic) ss 38(1)–(2); PJB v Melbourne Health (Patrick’s Case) (2011) VSC 327 [306], [309]–[312]; Antunovic v Dawson (2010) VSC 377 [70], [135]; Certain Children v Minister for Families and Children [2016] VSC 796 [206]; Baker v DPP [2017] VSCA 58 [57]–[58].}

_{13 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 29–31 [8.4]–[8.6]. These additional safeguards are discussed in later in this chapter.}

_{14 These occupational groups are based on the recommendations of the Kellam Report: Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015). Victoria Police’s implementation of the Kellam Report is covered in Chapter 11. See also Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 29–30 [8.3]–[8.5].}

_{15 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 29 [8.4]. As discussed in Chapter 11, these are the occupations identified and mentioned in the Kellam Report: Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 86.}

_{16 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 30 [8.5].}

_{17 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 31 [8.6].}

_{18 This data is based on people identified as either a lawyer, doctor, parliamentarian, court official, journalist or priest (described by Victoria Police as ‘Category 1’ human sources or the ‘Kellam Occupations’); or belonging to one of the following occupation categories: medical, parliament, government, religious, journalist (based on a manual search of human source files by Victoria Police). The Commission has manually adjusted the data to eliminate double counting of people belonging to both categories (for example, a doctor also identified as belonging to the ‘medical’ category). The data does not include people identified as having a ‘connection to’ a Category 1 human source (for example, the spouse of a lawyer), as introduced under the May 2020 version of the Human Source Policy.}

_{19 The Human Source Policy contains examples of people classified as ‘Category 4’ human sources; however, these examples cannot be included in this final report due to a public interest immunity claim by Victoria Police. Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 29 [8.3], 32 [8.9].}

_{20 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 29 [8.3].}

_{21 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 10 [3.1].}

_{22 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 47 [218]–[219].}

_{23 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 63 [286].}

_{24 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 62 [286].}

_{25 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 62 [286].}

_{26 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 14 [4.1], 26 [7.4].}

_{27 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 13–14 [3.6].}

_{28 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 12 [3.3].}

_{29 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 18 [5.1].}

_{30 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 14–15 [4.1], 18 [5.1].}

_{31 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 18 [5.1].}

_{32 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 18 [5.2].}

_{33 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 29 [8.4].}

_{34 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 10–11 [3.2], 15–16 [4.2].}

_{35 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 8 [2.7].}

_{36 The duty to authorise ‘low risk’ and ‘medium risk’ human sources is delegated by the CSR to the HSMU: Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 8 [2.7].}

_{37 As mentioned earlier, Categories 2–4 are also referred to the Human Source Ethics Committee for authorisation of their recruitment or registration.}

_{38 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 19 [5.3], 30–1 [8.6].}

_{39 Based on Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 8 [2.7], 10–11 [3.2], 31 [8.6].}

_{40 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 34 [8.15].}

_{41 Exhibit RC1534b Victoria Police, Human Source Ethics Committee Terms of Reference, 12 April 2020, 3–4 [12].}

_{42 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 29 [8.4].}

_{43 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 29 [8.4];Exhibit RC1534b Victoria Police, Human Source Ethics Committee Terms of Reference, 12 April 2020, 3–4 [12].}

_{44 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 31 [8.6].}

_{45 Based on Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 10–11 [3.2], 29 [8.4], 31 [8.6].}

_{46 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 12 [3.3].}

_{47 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 12 [3.3].}

_{48 Registration is authorised at two levels: Level 1: ‘Approved—Tasking may be undertaken’ and Level 2: ‘Approved—With Special Conditions’: Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 16 [4.3].}

_{49 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 3.}

_{50 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 39–40 [14].}

_{51 Victoria Police, ‘One-off Human Source Registration—Risk Assessment’, Undated (Version 1.0) 1, produced by Victoria Police in response to a Commission Notice to Produce.}

_{52 Victoria Police, ‘One-off Human Source Registration—Risk Assessment’, Undated (Version 1.0) 1, produced by Victoria Police in response to a Commission Notice to Produce.}

_{53 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 39–40 [14].}

_{54 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 39–40 [14].}

_{55 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 39–40 [14].}

_{56 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 39–40 [14].}

_{57 Victoria Police’s operational policing is divided across four geographical regions and 12 commands, all of which are led by an Assistant Commissioner.}

_{58 Victoria Police, ‘Untitled spreadsheet’, 27 July 2020, produced by Victoria Police in response to a Commission Notice to Produce.}

_{59 Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, Annexure 59, 6, 9.}

_{60 Exhibit RC1949 Letter from solicitors for Victoria Police to Solicitors Assisting the Commission, 26 June 2020, Annexure A, 10.}

_{61 Handlers of high-risk sources and officers from the HSMU have two opportunities to extend their original three-year tenure for another year, and senior handlers and controllers have one opportunity to extend their original five-year tenure for a further two years. All opportunities for extension are at the discretion of the Assistant Commissioner, Intelligence and Covert Support Command: Exhibit RC1949 Letter from solicitors for Victoria Police to Solicitors Assisting the Commission, 26 June 2020, Annexure B, 10, 13.}

_{62 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 23 [6.6].}

_{63 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 23 [6.6].}

_{64 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 19 [5.3]; Transcript of Deputy Commissioner Wendy Steendam, 7 May 2020, 14886.}

_{65 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 19 [5.3].}

_{66 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 19 [5.3].}

_{67 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 22 [6.5].}

_{68 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 22 [6.5].}

_{69 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 17 [5].}

_{70 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 17 [5], 43–4 [22]; Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 35 [159].}

_{71 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 14 [3.6].}

_{72 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 45 [214].}

_{73 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 12 [3.3].}

_{74 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 43–4 [22].}

_{75 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 43 [22].}

_{76 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 12 [3.3], 14 [3.6], 17 [5], 43–4 [22].}

_{77 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 43–4 [22].}

_{78 Exhibit RC1952 Statement of Assistant Commissioner Neil Paterson, 5 March 2020, 12 [89]–[91].}

_{79 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 45 [215].}

_{80 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 45–6 [215]; Transcript of Deputy Commissioner Wendy Steendam, 7 May 2020, 14911–12.}

_{81 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 5 [1.4], 38 [12].}

_{82 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 25 [7.3].}

_{83 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 34 [8.14].}

_{84 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 34 [8.14].}

_{85 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 20 [6.1].}

_{86 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 9 [2.8].}

_{87 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 21 [6.1].}

_{88 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 52 [235]; Victoria Police, ‘Human Source Management Training Evaluation Report (Version 3)’, 18 December 2019, 29 [10.3], produced by Victoria Police in response to a Commission Notice to Produce.}

_{89 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 52 [235].}

_{90 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 55 [250].}

_{91 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 20 [6.1].}

_{92 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 52 [235].}

_{93 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 18 [5.2].}

_{94 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 55 [253], 56 [256]–[257]; Victoria Police, ‘Outline of Changes to Basic Online Course’, Undated, 3, produced by Victoria Police in response to a Commission Notice to Produce.}

_{95 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 55–6 [253]–[254], 58 [265].}

_{96 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 53–4 [244]–[245].}

_{97 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 20 [6.1].}

_{98 Transcript of Deputy Commissioner Wendy Steendam, 7 May 2020, 14902.}

_{99 Responsive submission, Victoria Police, 28 September 2020, 3 [2.2]–[2.3].}

_{100 Consultation with South Australia Police, 6 September 2019; Consultation with Tasmania Police, 12 September 2019; Consultation with Western Australia Police, 24 September 2019; Consultation with Queensland Police, 8 October 2019; Consultation with New South Wales Police, 4 March 2020; Consultation with Northern Territory Police, 4 March 2020.}

_{101 Consultation with South Australia Police, 6 September 2019; Consultation with Tasmania Police, 12 September 2019; Consultation with Western Australia Police, 24 September 2019; Consultation with Queensland Police, 8 October 2019; Consultation with New South Wales Police, 4 March 2020; Consultation with Northern Territory Police, 4 March 2020.}

_{102 Consultation with South Australia Police, 6 September 2019; Consultation with Tasmania Police, 12 September 2019; Consultation with Western Australia Police, 24 September 2019; Consultation with Queensland Police, 8 October 2019; Consultation with Northern Territory Police, 4 March 2020.}

_{103 Consultation with South Australia Police, 6 September 2019; Consultation with Western Australia Police, 24 September 2019; Consultation with Queensland Police, 8 October 2019; Consultation with Northern Territory Police, 4 March 2020.}

_{104 Consultation with South Australia Police, 6 September 2019; Consultation with Western Australia Police, 24 September 2019; Consultation with Queensland Police, 8 October 2019; Consultation with Northern Territory Police, 4 March 2020.}

_{105 Consultation with South Australia Police, 6 September 2019; Consultation with Queensland Police, 8 October 2019.}

_{106 Consultation with South Australia Police, 6 September 2019; Consultation with Tasmania Police, 12 September 2019; Consultation with Western Australia Police, 24 September 2019; Consultation with Queensland Police, 8 October 2019; Consultation with New South Wales Police, 4 March 2020.}

_{107 Consultation with South Australia Police, 6 September 2019; Consultation with Tasmania Police, 12 September 2019; Consultation with Western Australia Police, 24 September 2019; Consultation with Queensland Police, 8 October 2019; Consultation with New South Wales Police, 4 March 2020; Consultation with Northern Territory Police, 4 March 2020.}

_{108 Consultation with South Australia Police, 6 September 2019; Consultation with Western Australia Police, 24 September 2019.}

_{109 Consultation with South Australia Police, 6 September 2019; Consultation with Tasmania Police, 12 September 2019; Consultation with Western Australia Police, 24 September 2019; Consultation with Queensland Police, 8 October 2019; Consultation with New South Wales Police, 4 March 2020; Consultation with Northern Territory Police, 4 March 2020.}

_{110 Consultation with New South Wales Police, 4 March 2020.}

_{111 Consultation with Tasmania Police, 12 September 2019. These are discussed in more detail later in this chapter under ‘Challenges and opportunities’.}

_{112 Consultation with South Australia Police, 6 September 2019; Consultation with Tasmania Police, 12 September 2019; Consultation with Western Australia Police, 24 September 2019; Consultation with Queensland Police, 8 October 2019.}

_{113 Consultation with South Australia Police, 6 September 2019; Consultation with Western Australia Police, 24 September 2019; Consultation with Queensland Police, 8 October 2019; Consultation with Northern Territory Police, 4 March 2020.}

_{114 Consultation with South Australia Police, 6 September 2019; Consultation with Western Australia Police, 24 September 2019; Consultation with Tasmania Police, 12 September 2019.}

_{115 Although lawyers and doctors are generally prohibited from being used as human sources under Northern Territory Police’s human source policy, those who work in legal or medical workplaces (for example, a receptionist at a law firm) are not: Consultation with Northern Territory Police, 4 March 2020.}

_{116 Section 12 of the Evidence Act 1939 (NT) establishes medical privilege. Under section 12, a medical practitioner must not disclose any doctor-patient communication in civil proceedings without the patient’s consent. This privilege, however, does not cover any communication made for a criminal purpose. Additionally, Part 7 of the Evidence Act protects confidential communications between a victim and their counsellor from disclosure in sexual assault proceedings. This protection does not extend to any information that: the victim or their guardian consents to be produced in evidence; is acquired by a doctor or nurse during a physical examination of the victim; or demonstrates a criminal fraud or perjury.}

_{117 New South Wales Police, Human Source Management Policy (June 2019) [3.2.1].}

_{118 New South Wales Police, Human Source Management Policy (June 2019) [3.2.1].}

_{119 Minister for Home Affairs, Minister’s Guidelines in relation to the performance by the Australian Security Intelligence Organisation of its functions and the exercise of its powers (August 2020) 2.}

_{120 Minister for Home Affairs, Minister’s Guidelines in relation to the performance by the Australian Security Intelligence Organisation of its functions and the exercise of its powers (August 2020) 11–12 [3.4].}

_{121 Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, 49 [5.30]. Victoria Police has also undertaken research tours to these countries. For example, in 2010 then Assistant Commissioner Jeffrey (Jeff) Pope and Acting Inspector Brian Horan visited the United Kingdom, the United States of America and Canada from 31 May to 18 June and met with ‘police and related agencies’. The purpose of their visit ‘was to learn more about their intelligence models and capability, their sex offender and human source management programs and to discover how organised crime and other intelligence related policing issues were being tackled’: Victoria Police, ‘2010 visit to the UK, USA and Canada by Victoria Police’, 2, produced by Victoria Police in response to a Commission Notice to Produce.}

_{122 See, eg, Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, 30 [4.33]; Transcript of Deputy Commissioner Wendy Steendam, 7 May 2020, 14853.}

_{123 Consultation with New Zealand Police, 20 September 2019.}

_{124 Consultation with New Zealand Police, 20 September 2019.}

_{125 Consultation with Royal Canadian Mounted Police, 19 September 2019.}

_{126 ‘About the Office’, United States Department of Justice (Web Page, 17 July 2018) .}

_{127 Office of the Attorney General (US), The Attorney General’s Guidelines regarding the use of confidential informants (2002) 1.}

_{128 In 2006, the United States Department of Justice issued the Federal Bureau of Investigations with its own set of Guidelines. Prior to the issuing of the FBI Guidelines, the FBI was governed by the 2002 Attorney General’s Guidelines regarding the use of confidential informants that apply to all other Department of Justice law enforcement agencies.}

_{129 Office of the Attorney General (US), The Attorney General’s Guidelines regarding the use of confidential informants (2002) 7, 14; Office of the Attorney General (US), The Attorney General’s Guidelines regarding the use of FBI confidential human sources (2006) 17–18.}

_{130 Consultation with United States Drug Enforcement Administration, 27 August 2019.}

_{131 Consultation with United States Drug Enforcement Administration, 27 August 2019.}

_{132 There is also Congressional Oversight of the DEA Sensitive Activities Committee: Consultation with United States Drug Enforcement Administration, 27 August 2019.}

_{133 Neil Comrie, Victoria Police Human Source 3838: A Case Review (Report, 30 July 2012).}

_{134 Exhibit RC1541 Regulation of Investigatory Powers Act 2000 (UK) pt 2 ss 26–48. While the Regulation of Investigatory Powers (Scotland) Act 2000 (Scot) applies in Scotland, this largely replicates the RIPA. For ease of reference, the Commission has focused primarily on the statutory framework set by the RIPA.}

_{135 Exhibit RC1543 Regulation of Investigatory Powers (Covert Human Intelligence Sources: Matters Subject to Legal Privilege) Order 2010 (UK) SI 2010/123; Exhibit RC1542 Regulation of Investigatory Powers (Directed Surveillance and Covert Human Intelligence Sources) Order 2010 (UK) SI 2010/521; Home Office (UK), Covert Human Intelligence Sources Revised Code of Practice (August 2018) issued pursuant to s 71 of the Regulation of Investigatory Powers Act 2000 (UK).}

_{136 Exhibit RC1541 Regulation of Investigatory Powers Act 2000 (UK) pt IV ss 57–64. The Investigatory Powers Act 2016 (UK) establishes the Investigatory Powers Commissioner and other Judicial Commissioners. In 2017, IPCO assumed responsibility for the oversight of investigatory powers from the Office of Surveillance Commissioners, the Interception of Communications Commissioner’s Office, and the Intelligence Services Commissioner.}

_{137 Khan v United Kingdom (2000) 5 Eur Court HR 279.}

_{138 Contrary to Article 8(2) of the Convention for the Protection of Human Rights and Fundamental Freedoms, opened for signature on 4 November 1950, 213 UNTS 221 (entered into force 3 September 1953). Prior to the Regulation of Investigatory Powers Act 2000 (UK), the Home Office’s Guidelines on the Use of Equipment in Police Surveillance Operations (Home Office, 1984) regulated the use of covert listening devices until Part III of the Police Act 1997 (UK) came into force on 22 February 1999. These guidelines were not reflected in law: Khan v United Kingdom (2000) 5 Eur Court HR 279.}

_{139 See United Kingdom, Parliamentary Debates, House of Commons, 6 March 2000, [767]–[768] (Jack Straw, Secretary of State for the Home Department); Exhibit RC1541 Regulation of Investigatory Powers Act 2000 (UK) s 29(2); Home Office (UK), Covert Human Intelligence Sources Revised Code of Practice (August 2018) 15 [3.3]–[3.5].}

_{140 Exhibit RC1541Regulation of Investigatory Powers Act 2000(UK) s 29(3).}

_{141 Home Office (UK), Covert Human Intelligence Sources Revised Code of Practice (August 2018) 15–16 [3.5].}

_{142 Exhibit RC1541 Regulation of Investigatory Powers Act 2000 (UK) ss 29(4), 30(1). In contrast to Victoria, the Regulation of Investigatory Powers Act 2000 (UK) s 32(6)(a) provides that a Chief Constable of a police service is the ‘senior authorising officer’ who has authority to approve an authorisation for ‘intrusive surveillance’. The position of Chief Constable in the United Kingdom is the equivalent of the Chief Commissioner of Police in Victoria.}

_{143 Home Office (UK), Covert Human Intelligence Sources Revised Code of Practice (August 2018) 10 [2.12]. See also Exhibit RC1541 Regulation of Investigatory Powers Act 2000 (UK) s 80.}

_{144 In the United Kingdom police services, ranks are as follows: Constable; Sergeant; Inspector; Chief Inspector; Superintendent; Chief Superintendent; Assistant Chief Constable; Deputy Chief Constable; and Chief Constable. See Exhibit RC1542 Regulation of Investigatory Powers (Directed Surveillance and Covert Human Intelligence Sources) Order 2010 (UK) SI 2010/521, Part 3 and Schedule Part 1.}

_{145 Exhibit RC1541Regulation of Investigatory Powers Act 2000(UK) ss 43(1)(a)(b), 43(3).}

_{146 Exhibit RC1541 Regulation of Investigatory Powers Act 2000 (UK), Regulation of Investigatory Powers (Covert Human Intelligence Sources: Matters Subject to Legal Privilege) Order 2010 (UK) SI 2010/123; Home Office (UK), Covert Human Intelligence Sources Revised Code of Practice (August 2018) 44 [8.27]–[8.28].}

_{147 Police Act 1997 (UK) ss 98(2)–(3).}

_{148 Police Act 1997 (UK) s 98(5)(b).}

_{149 Police Act 1997 (UK) ss 99–100.}

_{150 Home Office (UK), Covert Human Intelligence Sources Revised Code of Practice (August 2018) Annex A; Regulation of Investigatory Powers (Covert Human Intelligence Sources: Matters Subject to Legal Privilege) Order 2010 (UK) SI 2010/123, s 4(2).}

_{151 Home Office (UK), Covert Human Intelligence Sources Revised Code of Practice (August 2018) 49–50 [8.59]; Regulation of Investigatory Powers (Covert Human Intelligence Sources: Matters Subject to Legal Privilege) Order 2010 (UK) SI 2010/123, s 8(1)(b).}

_{152 Home Office (UK), Covert Human Intelligence Sources Revised Code of Practice (August 2018) 50 [8.60], Annex A.}

_{153 Home Office (UK), Covert Human Intelligence Sources Revised Code of Practice (August 2018) 50 [8.60].}

_{154 Home Office (UK), Covert Human Intelligence Sources Revised Code of Practice (August 2018) 50 [8.60].}

_{155 Home Office (UK), Covert Human Intelligence Sources Revised Code of Practice (August 2018) 44 [8.27], Annex A.}

_{156 Home Office (UK), Covert Human Intelligence Sources Revised Code of Practice (August 2018) 45 [8.33].}

_{157 Home Office (UK), Covert Human Intelligence Sources Revised Code of Practice (August 2018) 45 [8.33].}

_{158 Home Office (UK), Covert Human Intelligence Sources Revised Code of Practice (August 2018) 50 [8.61].}

_{159 Home Office (UK), Covert Human Intelligence Sources Revised Code of Practice (August 2018) 48 [8.51].}

_{160 Home Office (UK), Covert Human Intelligence Sources Revised Code of Practice (August 2018) 51 [8.62]–[8.65].}

_{161 Some of these laws were enacted as a result of a 2003 Standing Committee of Attorneys-General and Australasian Police Ministers Council Joint Working Group on National Investigation Powers report proposing that model laws for a national set of powers for cross-border investigations be developed. According to that report, the model laws aimed to enhance arrangements for investigating multi-jurisdictional crime. See, The Standing Committee of Attorneys-General and Australasian Police Ministers Council Joint Working Group on National Investigation Powers, Cross-border Investigative Powers for Law Enforcement (Report, November 2003) [i]–[iii]. In Victoria, examples of the legislation governing these powers include the Crimes (Assumed Identities) Act 2004 (Vic) for undercover investigations; Crimes (Controlled Operations) Act 2004 (Vic) for controlled operations; Surveillance Devices Act 1999 (Vic) for surveillance; and the Telecommunications (Interception and Access) Act 1979 (Cth) and the Telecommunications (Interception) (State Provisions) Act 1988 (Vic) for the interception of telephones or similar devices.}

_{162 Surveillance Devices Act 1999 (Vic) s 14.}

_{163 Surveillance Devices Act 1999 (Vic) s 17(2).}

_{164 Surveillance Devices Act 1999 (Vic) s 12D.}

_{165 Surveillance Devices Act 1999 (Vic) s 12C.}

_{166 Charter of Human Rights and Responsibilities Act 2006 (Vic) s 24.}

_{167 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 5 [1.3].}

_{168 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 41 [191], 42 [197]–[198].}

_{169 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 5 [1.3].}

_{170 Submission 111 Victorian Equal Opportunity and Human Rights Commission, 7.}

_{171 Submission 130 Clive Harfield, 3 [17]–[19], 4 [23], 6 [29].}

_{172 Exhibit RC1541 Regulation of Investigatory Powers Act 2000(UK) ss 29(2), (3); Home Office (UK), Covert Human Intelligence Sources Revised Code of Practice (August 2018) 10 [2.12], 15 [3.5], 16 [3.9], 46–7 [8.45].}

_{173 Consultation with United Kingdom Home Office, 13 November 2019.}

_{174 Consultation with Police Service Northern Ireland, 4 September 2019; Consultation with United Kingdom Home Office, 13 November 2019; Consultation with United Kingdom National Crime Agency, 28 April 2020.}

_{175 Consultation with Police Service Northern Ireland, 4 September 2019; Consultation with Police Scotland, 5 September 2019; Consultation with United Kingdom Home Office, 13 November 2019. Police Scotland pointed to the benefits of the Regulation of Investigatory Powers (Scotland) Act 2000 (UK), which is broadly consistent with the RIPA.}

_{176 Consultation with United Kingdom National Crime Agency, 28 April 2020.}

_{177 See, eg, Office of Police Integrity, Past Patterns—Future Directions, Victoria Police and the problem of corruption and serious misconduct (Parliamentary paper 4, February 2007); Office of Police Integrity, Annual Report 2008 (Report, 2008) 16–17; Exhibit RC0108 Review of the Victoria Police Drug Squad, November 2001.}

_{178 Consultation with Professor Alexandra Natapoff, 11 September 2019.}

_{179 Exhibit RC1540 Statement of Sir Jonathan (Jon) Murphy, 28 April 2020, 11 [74].}

_{180 Consultation with Independent Broad-based Anti-corruption Commission, 24 April 2020; Consultation with Dr John Buckley, 12 September 2019; Submission 98 International Commission of Jurists Victoria, 20 [32].}

_{181 Consultation with Independent Broad-based Anti-corruption Commission, 24 April 2020.}

_{182 Consultation with Public Interest Monitor, 11 March 2020.}

_{183 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 81 [345].}

_{184 See, eg, Standing Committee of Attorneys-General and Australasian Police Ministers Council Joint Working Group on National Investigation Powers, Cross-border Investigative Powers for Law Enforcement (Report, November 2003) [ii].}

_{185 Parliament of Victoria, Parliamentary Debates, Legislative Assembly, 4 May 2004, [852]–[853] (Andrew McIntosh).}

_{186 Exhibit RC1540 Statement of Sir Jonathan (Jon) Murphy, 28 April 2020, 3 [23]–[26].}

_{187 Consultation with United Kingdom National Crime Agency, 28 April 2020; Consultation with Police Service Northern Ireland, 4 September 2019; Consultation with Police Scotland, 5 September 2019.}

_{188 Consultation with United Kingdom Investigatory Powers Commissioner’s Office, 12 September 2019.}

_{189 Consultation with United Kingdom Home Office. 13 November 2019.}

_{190 For example, the Investigatory Powers Act 2016 (UK) updated and consolidated existing rules under the Regulation of Investigatory Powers Act 2000 (UK), to modernise legislation for investigatory powers involving digital tools activities, such as the intercepting of communications via email. The Code of Practice was updated in 2018 to align the use of human sources with covert surveillance powers and associated processes: Consultation with United Kingdom Home Office, 13 November 2019.}

_{191 Consultation with Independent Broad-based Anti-corruption Commission, 24 April 2020.}

_{192 Consultation with South Australia Police, 6 September 2019.}

_{193 Consultation with Queensland Police, 8 October 2019.}

_{194 Exhibit RC1540 Statement of Sir Jonathan (Jon) Murphy, 28 April 2020, 6 [42].}

_{195 Consultation with Tasmania Police, 12 September 2019; Consultation with Western Australia Police, 24 September 2019; Consultation with South Australia Police, 6 September 2019; Consultation with Queensland Police, 8 October 2019; Consultation with Northern Territory Police, 4 March 2020.}

_{196 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 68 [304].}

_{197 Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, 30 [4.33].}

_{198 Consultation with New South Wales Crime Commission, 18 November 2019; Consultation with Northern Territory Police, 4 March 2020; Consultation with New South Wales Police, 4 March 2020.}

_{199 Submission 101 Australasian Institute of Policing, 15 [44], 17.}

_{200 Consultation with Australian Federal Police, 10 July 2020.}

_{201 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 68 [302].}

_{202 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 69 [306].}

_{203 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 69 [306].}

_{204 Consultation with New South Wales Crime Commission, 18 November 2019; Consultation with New South Wales Police, 4 March 2020; Consultation with South Australia Police, 6 September 2019; Consultation with Tasmania Police, 12 September 2019.}

_{205 Murray Kellam, Report Concerning Victoria Police Handling of Human Source Code Name 3838 (Report, 6 February 2015) 86–7; Transcript of Deputy Commissioner Wendy Steendam, 7 May 2020, 14864.}

_{206 Consultation with South Australia Police, 6 September 2019; Consultation with Western Australia Police, 24 September 2019; Consultation with Queensland Police, 8 October 2019; Consultation with Northern Territory Police, 4 March 2020.}

_{207 The focus groups were conducted when an earlier version of the Human Source Policy, dated 2018, was in place.}

_{208 Transcript of Deputy Commissioner Wendy Steendam, 7 May 2020, 14870–1. See also 14951–2.}

_{209 Consultation with Sir Jonathan (Jon) Murphy, 11 October 2019.}

_{210 Consultation with Mr Gary Dobson, 15 October 2019.}

_{211 Exhibit RC1531b, Victoria Police Manual—Human Sources, 15 April 2020, 28–31 [8.1]–[8.6]; Exhibit RC1949 Letter from solicitors for Victoria Police to Solicitors Assisting the Commission, 26 June 2020, Annexure B, 12.}

_{212 Consultation with South Australia Police, 6 September 2019; Consultation with Western Australia Police, 24 September 2019; Consultation with Queensland Police, 8 October 2019; Consultation with New Zealand Police, 20 September 2019.}

_{213 Consultation with Northern Territory Police, 4 March 2020.}

_{214 Transcript of Deputy Commissioner Wendy Steendam, 7 May 2020, 14888.}

_{215 Consultation with Western Australia Police, 24 September 2019; Consultation with Northern Territory Police, 4 March 2020, Consultation with New Zealand Police, 20 September 2019.}

_{216 Consultation with Tasmania Police, 12 September 2019; Consultation with Queensland Police, 8 October 2019; Consultation with South Australia Police, 6 September 2019.}

_{217 Exhibit RC1540 Statement of Sir Jonathan (Jon) Murphy, 28 April 2020, 7 [51]–[53].}

_{218 Transcript of Sir Jonathan Murphy, 13 May 2020, 14972.}

_{219 Exhibit RC1171b Statement of Mr Kenneth (Ken) Lay, 9 February 2020, 2–3; Transcript of Mr Kenneth (Ken) Lay, 10 February 2020, 13560–1.}

_{220 Transcript of Mr Kenneth (Ken) Lay, 10 February 2020, 13560–1.}

_{221 Transcript of Deputy Commissioner Wendy Steendam, 7 May 2020, 14878, 14891.}

_{222 Responsive submission, Victoria Police, 28 September 2020, 7 [5.5].}

_{223 Transcript of Deputy Commissioner Wendy Steendam, 7 May 2020, 14890, 14895–7.}

_{224 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 12 [58].}

_{225 Transcript of Deputy Commissioner Wendy Steendam, 7 May 2020, 14887–9.}

_{226 Transcript of Deputy Commissioner Wendy Steendam, 7 May 2020, 14883, 14888–90.}

_{227 Transcript of Deputy Commissioner Wendy Steendam, 7 May 2020, 14891, 14897.}

_{228 Transcript of Deputy Commissioner Wendy Steendam, 7 May 2020, 14897.}

_{229 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 27 [131]; Transcript of Deputy Commissioner Wendy Steendam, 7 May 2020, 14876–7.}

_{230 Transcript of Deputy Commissioner Wendy Steendam, 7 May 2020, 14876–8.}

_{231 Consultation with Professor Alexandra Natapoff, 11 September 2019.}

_{232 Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, 55 [5.61].}

_{233 Consultation with Police Service of Northern Ireland, 4 September 2019.}

_{234 Consultation with United Kingdom National Crime Agency, 28 April 2020.}

_{235 Consultation with Queensland Police, 8 October 2019.}

_{236 The engagement with the Principal Legal Officer is currently on an ‘as needs’, case-by-case basis; however, it is intended that this engagement will have a more formalised structure with the implementation of a new Human Source Policy and guidelines, which remained under development at the time of this report: Consultation with Tasmania Police, 12 September 2019.}

_{237 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 34–5 [158]–[159].}

_{238 Exhibit RC1949 Letter from solicitors for Victoria Police to Solicitors Assisting the Commission, 26 June 2020, Annexure A, 10.}

_{239 Victoria Police, ‘Victoria Police—Human Source Risk Assessment (Version 2)’, May 2015, 6, produced by Victoria Police in response to a Commission Notice to Produce.}

_{240 Victoria Police, ‘One-off Human Source Registration—Risk Assessment (Version 1.0)’, Undated, 1, produced by Victoria Police in response to a Commission Notice to Produce; Victoria Police, ‘Human Source Dynamic Risk Assessment’, 3, produced by Victoria Police in response to a Commission Notice to Produce.}

_{241 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 30 [8.5].}

_{242 Transcript of Deputy Commissioner Wendy Steendam, 7 May 2020, 14875–6.}

_{243 Submission 111 Victorian Equal Opportunity and Human Rights Commission, 3–4.}

_{244 ‘Human Rights’, Victorian Equal Opportunity and Human Rights Commission (Web Page) .}

_{245 Email from Neil Comrie to the Commission, 13 November 2019; Neil Comrie, Victoria Police Human Source 3838: A Case Review (Report, 30 July 2012) 20, 61.}

_{246 Transcript of Deputy Commissioner Wendy Steendam, 7 May 2020, 14884–5.}

_{247 Transcript of Deputy Commissioner Wendy Steendam, 7 May 2020, 14884–5.}

_{248 Exhibit RC1540, Statement of Sir Jonathan (Jon) Murphy, 28 April 2020, 12 [76].}

_{249 Home Office (UK), Covert Human Intelligence Sources Revised Code of Practice (August 2018) 15–16 [3.5].}

_{250 Home Office (UK), Covert Human Intelligence Sources Revised Code of Practice (August 2018) 27 [5.11].}

_{251 Consultation with Mr Gary Dobson, 15 October 2019. The Commission was not able to independently confirm that the number of registered human sources declined in New South Wales following the Royal Commission into the New South Wales Police Service (commonly known as the ‘Wood Royal Commission’).}

_{252 Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, Annexure 57, 22–33.}

_{253 Exhibit RC1532b Victoria Police, Covert Services Division, Intelligence & Covert Support Command, Human Source Strategy 2018–2022 (draft v7): A Better Way to Manage Risk, Undated, 2, 14. This draft document was not progressed nor endorsed by Victoria Police Executive Command; however, Ms Steendam told the Commission it was drafted by relevant members of the Intelligence and Covert Support Command who were subject matter experts: see Transcript of Deputy Commissioner Wendy Steendam, 7 May 2020, 14867.}

_{254 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 35 [159], 37 [171].}

_{255 Transcript of Deputy Commissioner Wendy Steendam, 7 May 2020, 14900.}

_{256 See, eg, Confidential consultation, 4 February 2020; Consultation with Queensland Police, 8 October 2019.}

_{257 Consultation with New Zealand Police, 20 September 2019; Consultation with Queensland Police, 8 October 2019.}

_{258 Consultation with Queensland Police, 8 October 2019.}

_{259 Consultation with Dr Adrian James, 6 November 2019.}

_{260 Consultation with Adjunct Associate Professor Charl Crous and Associate Professor Pamela Henry, 10 September 2019.}

_{261 Consultation with New Zealand Police, 20 September 2019; Consultation with Sir Jonathan (Jon) Murphy, 11 October 2019.}

_{262 Consultation with Western Australia Police, 24 September 2019; Exhibit RC1540 Statement of Sir Jonathan (Jon) Murphy, 28 April 2020, 11 [74].}

_{263 Transcript of Deputy Commissioner Wendy Steendam, 7 May 2020, 14896.}

_{264 Transcript of Deputy Commissioner Wendy Steendam, 7 May 2020, 14896.}

_{265 Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, 71 [11.8].}

_{266 The focus groups were conducted when an earlier version of the Human Source Policy, dated 2018, was in place. The policy provisions relating to ‘intrusive supervision’ under that policy are the same as those under the current version of Human Source Policy.}

_{267 Exhibit RC1532b Victoria Police, Covert Services Division, Intelligence & Covert Support Command, Human Source Strategy 2018–2022 (draft v7): A Better Way to Manage Risk, Undated, 2, 6–7, 13.}

_{268 Exhibit RC1532b Victoria Police, Covert Services Division, Intelligence & Covert Support Command, Human Source Strategy 2018–2022 (draft v7): A Better Way to Manage Risk, Undated, 13.}

_{269 Exhibit RC1540 Statement of Sir Jonathan Murphy, 28 April 2020, 7 [52].}

_{270 Consultation with Dr Adrian James, 6 November 2019.}

_{271 Consultation with Royal Canadian Mounted Police, 19 September 2019; Consultation with New Zealand Police, 20 September 2019; Consultation with Police Scotland, 5 September 2019.}

_{272 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 55 [253].}

_{273 Victoria Police, ‘Human Source Management Training Evaluation Report (Version 3)’, 18 December 2019, 29 [10.3], produced by Victoria Police in response to a Commission Notice to Produce.}

_{274 Victoria Police, ‘Human Source Management Training Evaluation Report (Version 3)’, 18 December 2019, 29 [10.3], produced by Victoria Police in response to a Commission Notice to Produce.}

_{275 Victoria Police, ‘Human Source Management Training Evaluation Report (Version 3)’, 18 December 2019, 29 [10.3], produced by Victoria Police in response to a Commission Notice to Produce.}

_{276 Consultation with Dr John Buckley, 12 September 2019.}

_{277 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 53–4 [244]–[245].}

_{278 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 20 [6.1]. The Commission has adopted this somewhat vague terminology due to a claim of public interest immunity by Victoria Police.}

_{279 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 54 [249]; Transcript of Deputy Commissioner Wendy Steendam, 7 May 2020, 14904, 14906–7.}

_{280 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 54 [246]; Transcript of Deputy Commissioner Wendy Steendam, 7 May 2020, 14903.}

_{281 Transcript of Deputy Commissioner Wendy Steendam, 7 May 2020, 14906.}

_{282 Responsive submission, Victoria Police, 28 September 2020, 3–4 [2.5].}

_{283 Responsive submission, Victoria Police, 28 September 2020, 3 [2.3], 3–4 [2.5].}

_{284 Consultation with Royal Canadian Mounted Police, 19 September 2019; Consultation with Police Scotland, 5 September 2019; Consultation with Police Service Northern Ireland, 4 September 2019.}

_{285 Consultation with Sir Jonathan (Jon) Murphy, 11 October 2019; Transcript of Sir Jonathan (Jon) Murphy, 13 May 2020, 15004–5.}

_{286 Exhibit RC1540 Statement of Sir Jonathan (Jon) Murphy, 28 April 2020, 9 [61].}

_{287 Exhibit RC1540 Statement of Sir Jonathan (Jon) Murphy, 28 April 2020, 11 [74].}

_{288 Exhibit RC1540 Statement of Sir Jonathan (Jon) Murphy, 28 April 2020, 9 [60].}

_{289 Consultation with Western Australia Police, 24 September 2019; Consultation with Queensland Police, 8 October 2019.}

_{290 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 55 [253]; Exhibit RC1949 Letter from solicitors for Victoria Police to Solicitors Assisting the Commission, 26 June 2020, Annexure A, 6.}

_{291 Exhibit RC1949 Letter from solicitors for Victoria Police to Solicitors Assisting the Commission, 26 June 2020, Annexure A, 6.}

_{292 Exhibit RC1949 Letter from solicitors for Victoria Police to Solicitors Assisting the Commission, 26 June 2020, Annexure B, 12; Charter of Human Rights and Responsibilities Act 2006 (Vic) ss 9, 13, 14, 16, 17, 19, 25; Victoria Police, ‘Outline of Changes to Basic Online Training’, Undated, 9, produced by Victoria Police in response to a Commission Notice to Produce.}

_{293 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 54 [249], 57 [259]–[263]; Exhibit RC1949 Letter from solicitors for Victoria Police to Solicitors Assisting the Commission, 26 June 2020, Annexure B, 12.}

_{294 Victoria Police, ‘Human Source Management Training Evaluation Report’, 18–21 [9]–[10.6], produced by Victoria Police in response to a Commission Notice to Produce.}

_{295 Exhibit RC1949 Letter from solicitors for Victoria Police to Solicitors Assisting the Commission, 26 June 2020, Annexure B, 12; Responsive submission, Victoria Police, 28 September 2020, 4 [2.5], 5–6 [4.2].}

_{296 Consultation with United Kingdom College of Policing, 4 December 2019.}

_{297 Consultation with Sir Jonathan (Jon) Murphy, 11 October 2019.}

_{298 Exhibit RC1949 Letter from solicitors for Victoria Police to Solicitors Assisting the Commission, 26 June 2020, Annexure A, 6–7.}

_{299 Letter from solicitors for Victoria Police to Solicitors Assisting the Commission, 17 August 2020, 3.}

_{300 Victoria Police, ‘Outline of Changes to Basic Online Training’, Undated, 3, produced by Victoria Police in response to a Commission Notice to Produce.}

_{301 Consultation with United Kingdom College of Policing, 4 December 2019.}

_{302 Consultation with Dr John Buckley, 12 September 2019.}

_{303 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 55 [253].}

_{304 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 65 [288]; Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, 12 [3.44].}

_{305 Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, 12 [3.44], 27 [4.18], 70 [11.6], 71 [11.8].}

_{306 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 61 [281].}

_{307 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 62–3 [286].}

_{308 Letter from solicitors for Victoria Police to Solicitors Assisting the Commission, 17 August 2020, 4.}

_{309 Victoria Police’s Law Enforcement Assistance Program (LEAP) is an online database that stores information about all crimes, family incidents and missing persons bought to police attention.}

_{310 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 65 [288].}

_{311 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 66 [293], 67 [301]; Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, 56 [5.65].}

_{312 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 50 [229], 66 [291].}

_{313 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 44–6 [208]–[216].}

_{314 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 44 [208].}

_{315 Consultation with Dr Adrian James, 6 November 2019.}

_{316 Consultation with Mr Gary Dobson, 15 October 2019.}

_{317 Consultation with Queensland Police, 8 October 2019; Consultation with Tasmania Police, 12 September 2019; Consultation with Northern Territory Police, 4 March 2020; Consultation with Western Australia Police, 24 September 2019.}

_{318 See, eg, Consultation with Tasmania Police, 12 September 2019.}

_{319 See, eg, Consultation with the New South Wales Crime Commission, 18 November 2019; Consultation South Australia Police, 6 September 2019.}

_{320 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 45–46 [215].}

_{321 Responsive submission, Victoria Police, 28 September 2020, 10 [5.21].}

_{322 Transcript of Deputy Commissioner Wendy Steendam, 7 May 2020, 14912.}

_{323 Transcript of Deputy Commissioner Wendy Steendam, 7 May 2020, 14912–13.}

_{324 Victoria Police, Annual Report 2018–19, (Report, October 2019) Appendix E, 55.}

_{325 This audit was conducted against the provisions of the previous Human Source Policy: Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, Annexure 48; Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 47–8 [221]–[222]; Exhibit RC1952 Statement of Assistant Commissioner Neil Paterson, 5 March 2020, 13–14 [102]–[107].}

_{326 This audit was conducted against the provisions of the previous Human Source Policy: Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019; Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 47–8 [221]–[223]; Exhibit RC1952 Statement of Assistant Commissioner Neil Paterson, 5 March 2020, 13–14 [102]–[107].}

_{327 Exhibit RC1532b Victoria Police, Covert Services Division, Intelligence & Covert Support Command, Human Source Strategy 2018–2022 (draft v7): A Better Way to Manage Risk, Undated, 2, 5, 6, 15.}

_{328 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 19 [5.3].}

_{329 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 31 [8.6].}

_{330 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 19 [5.3], 30 [8.5].}

_{331 Consultation with Public Interest Monitor, 11 March 2020.}

_{332 Letter from solicitors for Victoria Police to Solicitors Assisting the Commission, 31 March 2020, 2–3.}

_{333 Exhibit RC1538 Statement of Inspector Ilena Pucar, 7 May 2020, 7–8 [6.1]–[6.12].}

_{334 Letter from solicitors for Victoria Police to Solicitors Assisting the Commission, 30 October 2020.}

_{335 Home Office (UK), Covert Human Intelligence Sources Revised Code of Practice (August 2018) 45 [8.33]–[8.36], 48 [8.51], 52 [8.70]–[8.71].}

_{336 Home Office (UK), Covert Human Intelligence Sources Revised Code of Practice (August 2018) 39 [8.3].}

_{337 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 49 [225]–[226].}

_{338 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 49 [227].}

_{339 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 49 [228]–[229]; 53 [243].}

_{340 Responsive submission, Victoria Police, 28 September 2020, 5 [3.4].}

_{341 Consultation with Western Australia Police, 24 September 2019.}

_{342 Home Office (UK), Covert Human Intelligence Sources Revised Code of Practice (August 2018) 10 [2.12].}

_{343 Consultation with Police Service of Northern Ireland, 4 September 2019.}

_{344 Consultation with Sir Jonathan (Jon) Murphy, 11 October 2019; Transcript of Sir Jonathan (Jon) Murphy, 13 May 2020, 14985, 14989–90, 14994–5.}

_{345 Exhibit RC1540 Statement of Sir Jonathan (Jon) Murphy, 28 April 2020, 8 [59].}

_{346 Consultation with Police Scotland, 5 September 2019.}

_{347 Consultation with Metropolitan Police Service, 17 October 2019. The term ‘evidentiary chain’ refers to the demonstrated continuous possession of evidence by police, from its collection through to its use in a prosecution or disposal.}

_{348 Exhibit RC0276 Review and Develop Best Practice Human Source Management Policy, 2004, 2, 17–21, 29–30.}

_{349 Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, Annexure 59, 10–12; Exhibit RC1784 Victoria Police, ‘Corporate Management Review Division—Evaluation of Dedicated Source Unit—Pilot’, April 2005, 11, 15–16; Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, Annexure 56, 30.}

_{350 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 23 [6.6].}

_{351 Exhibit RC1531b Victoria Police Manual—Human Sources, 15 April 2020, 23 [6.6].}

_{352 Consultation with Western Australia Police, 24 September 2019; Consultation with South Australia Police, 6 September 2019; Consultation with New South Wales Crime Commission, 18 November 2019; Consultation with Police Service Northern Ireland, 4 September 2019; Consultation with Police Scotland, 5 September 2019; Consultation with New Zealand Police, 20 September 2019; Consultation with Metropolitan Police Service, 17 October 2019. While Tasmania Police does not currently adopt a sterile corridor in its management of human sources, this approach is being reviewed in its updated policy: Consultation with Tasmania Police, 12 September 2019.}

_{353 See, eg, Consultation with Western Australia Police, 24 September 2019.}

_{354 Clive Harfield, ‘Police Informers and Professional Ethics’ (2012) 31(2) Criminal Justice Ethics, 73, 89.}

_{355 Consultation with New South Wales Police, 4 March 2020.}

_{356 Consultation with Dr Adrian James, 6 November 2019.}

_{357 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 49–50 [229], 87–8 [370]–[374].}

_{358 Responsive submission, Victoria Police, 28 September 2020, 1 [1.1]–[1.2].}

_{359 Exhibit RC0008 Statement of Assistant Commissioner Neil Paterson, 22 March 2019, 55 [5.58]; Submission 101 Australasian Institute of Policing, 14 [35]–[37]; Consultation with Royal Canadian Mounted Police, 19 September 2019.}

_{360 Responsive submission, Victoria Police, 28 September 2020, 2 [1.4].}

_{361 Exhibit RC1529b Statement of Deputy Commissioner Wendy Steendam, 16 April 2020, 76–7 [326]–[327], 81 [345].}

_{362 Responsive submission, Victoria Police, 28 September 2020, 8–9 [5.13].}

_{363 Responsive submission, Victoria Police, 20 September 2020, 7 [4.11].}

_{364 Responsive submission, Victoria Police, 28 September 2020, 9 [5.14]–[5.15].}

_{365 Transcript of Deputy Commissioner Wendy Steendam, 7 May 2020, 14877.}

_{366 Responsive submission, Victoria Police, 28 September 2020, 5–6 [4.2]–[4.4].}

_{367 Responsive submission, Victoria Police, 28 September 2020, 5 [3.3].}

_{368 Responsive submission, Victoria Police, 28 September 2020, 10 [5.18]–[5.19].}

_{369 Responsive submission, Victoria Police, 28 September 2020, 10 [5.21].}

_{370 Institute of Internal Auditors, ‘The Three Lines of defense in Risk Management and Control’ (Position paper, January 2013) 2 .}

_{371 Institute of Internal Auditors, ‘The Three Lines of defense in Risk Management and Control’ (Position paper, January 2013) 2 .}

_{372 Responsive submission, Victoria Police, 28 September 2020, 10–11 [5.23].}

_{373 See, eg, PwC, “Coordinated control: the ‘four lines of defence’ model”, Disclose (Issue 1, 2015) .}

Introduction

Term of reference 3 required the Commission to inquire into and report on the current adequacy and effectiveness of Victoria Police’s processes for the management of human sources subject to legal obligations of confidentiality or privilege. As noted in Chapter 4, the Commission was primarily concerned with legal obligations of confidentiality and privilege arising from professional relationships, and by extension, confidential and privileged information derived from those relationships. In this chapter, the Commission uses the term ‘confidential or privileged information’ in this context.

Term of reference 5b required the Commission to inquire into and report on recommended measures that may be taken to address any systemic or other failures in Victoria Police’s processes for its disclosures about and recruitment, handling and management of this category of human sources. As part of its inquiry into these terms of reference, the Commission considered the need for, and potential benefits of, an external oversight regime for Victoria Police’s use of human sources.

Independent, external oversight encourages police to use their significant powers fairly and to develop and maintain consistently high ethical and professional standards. It also helps to hold police to account when this does not occur and provides critical public assurance that even when police are acting covertly, they are also acting lawfully. In this way, external oversight can help to build, maintain and improve both public trust and confidence in policing, and the quality of work done by police.

This chapter explains why external oversight of police powers and actions is important; describes different oversight models; outlines oversight arrangements for other police powers in Victoria; and identifies the key bodies that make up the current police oversight system—in particular, the Public Interest Monitor (PIM), Victorian Inspectorate (VI) and Independent Broad-based Anti-corruption Commission (IBAC). It then looks at the limited external oversight currently in place for Victoria Police’s use of human sources, along with oversight regimes in other Australian jurisdictions and the United Kingdom.

The chapter also outlines the views of stakeholders consulted by the Commission, including views about the need for stronger external oversight of Victoria Police’s use of human sources, the benefits external oversight offers and the concerns it raises. It then considers evidence heard by the Commission on the features of an effective external oversight model, and the resources and expertise required to administer it.

Taking that research and evidence into account, the Commission concludes that the current lack of external oversight of Victoria Police’s use of human sources is an undesirable gap in the police oversight system. While the use of human sources is a powerful, legitimate tool to detect and prevent crime, the case of Ms Nicola Gobbo amply demonstrates that, used improperly, it can adversely affect individual rights and the administration of justice. External oversight provides a powerful safeguard to ensure that police act ethically, lawfully and with due regard to human rights. The absence of an independent check on Victoria Police’s use of human sources is also at odds with the oversight regimes in place for its use of other covert powers and methods, including surveillance devices, telecommunication intercepts and controlled operations.

Guided by lessons learned in other jurisdictions, and principles of proportionality and accountability, the Commission recommends the establishment of a tiered external oversight model that applies generally to Victoria Police’s use of human sources, with greater scrutiny of decisions about human sources who are reasonably expected to have access to confidential or privileged information (‘reportable human sources’).

The oversight model recommended by the Commission consists of three tiers:

• The PIM would test the appropriateness and rigour of Victoria Police decision making related to the registration of reportable human sources.
• IBAC would monitor Victoria Police’s compliance with the human source management framework recommended by the Commission (outlined in Chapter 12).
• IBAC would retain its current role to review and investigate complaints against Victoria Police officers, including any complaints that may relate to officers’ use of human sources.

The Commission also considers that there may be merit in the Victorian Government reviewing the broader system for external oversight of Victoria Police, particularly the oversight of its use of covert powers, with a view to achieving greater system consistency and coherence.

Current context and practice

This section discusses why police and other law enforcement agencies are subject to external oversight and examines the current institutional and legislative framework for the oversight of Victoria Police.

It outlines:

• the role of independent external oversight of police
• the current police oversight system in Victoria
• approaches to external oversight of the use and management of human sources in Australian and international jurisdictions.

These topics are discussed in turn below.

The role of independent external oversight of police

Independent, external oversight of police is an important check and balance on the use of their wide and significant powers. It aims to ensure that police treat people fairly and act ethically, lawfully and with high professional standards. It balances power with accountability, building public trust and confidence in police.

External oversight of police is necessary and important because, as noted in the Commission of Inquiry into Possible Illegal Activities and Associated Police Misconduct report into police corruption in Queensland, police officers hold ‘extensive authority over all other citizens, however powerful, coupled with wide discretions concerning its exercise’.¹ As the Royal Commission into the New South Wales Police Service described it:

The powers entrusted to police to carry arms, to use coercive force in the proper course of their duties (and, in extreme circumstances, to take lives), to inquire into personal affairs and to eavesdrop (pursuant to a warrant) on private conversations, to deprive citizens of their liberty, to enter and search their premises, to seize and hold their property, and to initiate proceedings that will require them to defend themselves before the courts, are very substantial powers—possessed by no other class of employee.²

In Victoria, police authority over citizens includes a range of common law and legislative powers to prevent and investigate crime and maintain public order. Often, these powers intrude upon certain human rights in order to uphold others, like a person’s right to life and security and property rights. For example, powers to arrest, preventatively detain, move on and restrict association can limit personal freedoms of movement and association. Investigative powers, such as searches of property, telecommunications interception and use of surveillance devices, curtail personal privacy rights, often without a person’s knowledge.

In Victoria and elsewhere, police officers have significant discretion to decide how and when they use their powers.³ Such discretion is vulnerable to being used arbitrarily, unfairly or in a corrupt manner.⁴ When police powers are used improperly, it can negatively affect not only the individuals subject to them, but also the broader community and its institutions, by reducing trust in the police service and in the criminal justice system.⁵

Governments and academic commentators have recognised the need for external oversight of covert police powers; that is, powers exercised without the knowledge of affected persons. Former police officer, Professor Clive Harfield, University of Queensland, explained:

… the arena of covert investigation is potentially more vulnerable [to corruption], since such investigation, by definition, cannot be challenged by the subject of the investigation in ways that overt investigation powers can be.⁶

More specifically, serving Western Australian police officer and Adjunct Associate Professor, Dr Charl Crous, APM has identified that the covert relationships between police and human sources can lead to corruption and unethical behaviour.⁷

In 2011, risks inherent to the exercise of covert powers prompted the Victorian Parliament to establish an additional oversight and accountability mechanism in the form of the PIM, which commenced operations in 2013. The then responsible Minister described the policy rationale for the PIM as follows:

Covert investigations and coercive powers … are among the most intrusive powers available to integrity and law enforcement bodies in Victoria.

Strong accountability measures should exist for the use of such significant powers. It is critical that the Victorian community has full confidence that applications for covert investigation and coercive powers are subject to optimal safeguards and oversight.⁸

External oversight complements internal governance and control mechanisms, which are critical to ensuring proper and lawful conduct among police, and improving accountability and organisational performance.⁹ As with any organisation, Victoria Police has primary responsibility for ensuring the integrity and professional conduct of its employees, consistent with legislative requirements, the organisation’s code of conduct and values, and broader public sector standards.¹⁰

Current external oversight of Victoria Police

Victoria’s current institutional structure for external oversight of Victoria Police has been in place since 2013. Although there have not been any significant legislative changes since then, the Victorian Parliament has given additional functions to oversight agencies when new police powers have been introduced or existing powers increased.

Within this structure, Victoria Police is subject to external oversight by several agencies:

• IBAC exercises a broad police integrity and oversight jurisdiction by assessing and investigating allegations of police misconduct and corruption.
• IBAC, the VI, PIM, courts and tribunals and the Commonwealth Ombudsman oversee Victoria Police’s use of specific powers and functions, including various powers that are exercised covertly.

Other than Victoria Police itself, IBAC is the only Victorian public sector agency that can investigate allegations against police officers.¹¹

There is currently no external oversight of Victoria Police’s use of human sources, other than potentially through the investigation of a complaint by IBAC, an IBAC own motion investigation (that is, an investigation IBAC initiates itself), or an inquiry or royal commission established under the Inquiries Act 2014 (Vic) to examine a particular issue. This is discussed further below.

The current external oversight arrangements reflect the Victorian and Commonwealth Parliaments’ recognition of the need for independent scrutiny of, and accountability for, Victoria Police’s exercise of extensive powers to prevent and investigate crime.¹²

While there is considerable variation in powers, functions, obligations and enabling legislation, external oversight in Victoria falls into three broad categories: involvement in decision making; review of decisions and/or monitoring compliance with legislation; and review and investigation of complaints.

These three categories are outlined in Figure 13.1 and discussed below.

Figure 13.1: Three categories of external oversight of Victoria Police

Some police powers are subject to one type of oversight only; for example, monitoring of Victoria Police’s compliance with DNA sampling laws is overseen by IBAC and no other body.¹³ Other powers are subject to a tiered approach, with different agencies performing different oversight functions.

Figure 13.2 below provides a snapshot of how the three oversight categories apply across various Victoria Police powers and functions, some of which are comparable to the use of human sources due to their covert nature and/or their lawful limitation of human rights. Certain other Victorian law enforcement and integrity bodies can also use some of these powers.¹⁴

The enabling legislation for all of these powers and functions requires the agency exercising the power or function and/or the oversight agency to report to the responsible Minister or Parliament about their exercise and, in some cases, the effectiveness or appropriateness of their use.

Figure 13.2: External oversight of certain Victoria Police powers and functions ¹⁵

Involvement in decision making

The first category of external oversight in Victoria is involvement in decisions about the use of certain powers by police.

Victoria Police is often required to apply to a court for authorisation to use covert powers. These applications are heard ex parte—that is, without notice to, or hearing from, the person proposed to be subject to the use of these powers (often referred to as the ‘target’). In some cases, the PIM has a statutory role to test the content and sufficiency of police applications to use such powers; for example, in relation to surveillance devices, telecommunications interceptions and covert search warrants.

As the decision maker, the court must weigh up the evidence supporting the police application and decide whether the legal test for granting the authorisation has been met. For example, a judge or magistrate may issue a surveillance device warrant if satisfied that there are reasonable grounds for the suspicion or belief that an offence has or will occur, and that a surveillance device will help gather evidence. In making this decision, the court has regard to:

• the nature and gravity of the alleged offence in respect of which the warrant is sought
• the extent to which the privacy of any person is likely to be affected
• the existence of any alternative means of obtaining the evidence or information sought to be obtained
• the evidentiary or intelligence value of any information sought to be obtained
• any previous warrant sought or issued in connection with the same offence
• any submissions the PIM has made.¹⁶

As noted above, since 2013, the PIM has provided an additional safeguard for certain covert powers and functions exercised by police.¹⁷ The PIM’s role in ex parte applications is to ‘represent the public interest and provide greater accountability in the collection of evidence from warrants and orders that intrude on the privacy and civil liberties of Victorian citizens’.¹⁸

This safeguard operates by:

• Victoria Police notifying the PIM of relevant applications to the court and providing the PIM with documents relating to the application
• the PIM appearing at a hearing to test the sufficiency of the information relied upon and the circumstances of the application; and making submissions as to the appropriateness of granting the application.¹⁹

An example of this form of oversight is the PIM’s involvement in applications for covert search warrants under the Terrorism (Community Protection) Act 2003 (Vic), outlined in Box 13.1.

Since commencing operation in 2013, the PIM’s role has expanded to include involvement in decisions made by Victoria Police (in addition to decisions made by a court) about its exercise of certain powers and functions; specifically, police detention decisions relating to terrorism suspects and administration of the witness protection scheme. The role of the PIM in relation to the witness protection scheme is outlined in Box 13.2 below.²⁵ Procedural requirements for the PIM’s involvement in these decisions broadly mirror those that underpin its involvement in court decisions about Victoria Police’s use of other covert powers.

Review of decisions and/or monitoring compliance with legislation

The second category of external oversight in Victoria is reviewing decisions and/or monitoring compliance with legislation. While arrangements vary across regimes, in Victoria this type of oversight often focuses primarily on Victoria Police’s compliance with procedural requirements, such as record keeping.

The VI and IBAC have primary responsibility for compliance monitoring under Victorian law. The VI currently monitors Victoria Police's and IBAC's compliance with legislation regulating covert or intrusive powers that both of these agencies are able to use in conducting their investigations, such as telecommunications interception and use of surveillance devices.³³ IBAC monitors Victoria Police compliance with legislation regulating certain powers and functions that are conferred on Victoria Police alone; for example, DNA sampling and making of firearm prohibition orders. In some cases, IBAC has a deeper oversight function that goes beyond assessing compliance with record-keeping requirements and involves reviewing the appropriateness of Victoria Police decisions.

Table 13.1 outlines some of the key compliance-monitoring regimes relevant to Victoria Police powers and functions. There are also other statutory schemes that provide for external oversight of Victoria Police powers and functions. For example, IBAC also has a range of other compliance-monitoring responsibilities under the Firearms Act 1996 (Vic) (Firearms Act), Sex Offenders Registration Act 2004 (Vic), Crimes Act 1958 (Vic), Drugs, Poisons and Controlled Substances Act 1981 (Vic) and the Terrorism (Community Protection) Act 2003 (Vic).

Table 13.1: Examples of compliance monitoring regimes in relation to Victoria Police³⁴

As detailed in Box 13.3, the VI also undertakes compliance monitoring of Victoria Police’s use of powers relating to telecommunications interception; that is, where an agency can intercept the communication passing over a telecommunications system without the knowledge of the people engaged in the communication.

Box 13.4 below outlines IBAC’s oversight role in relation to Victoria Police’s making of firearm prohibition orders. These orders prohibit a person from acquiring a firearm or related item. IBAC’s oversight role involves reviewing not just Victoria Police’s compliance with record-keeping or other procedural requirements, but also the appropriateness of its decisions about issuing such orders and its administration of the broader scheme.

Review and investigation of complaints

The third category of external oversight in Victoria is the review and investigation of complaints. This involves IBAC’s review and investigation of complaints under its broad police integrity jurisdiction. Under the Independent Broad-based Anti-corruption Commission Act 2011 (Vic) (IBAC Act), IBAC’s functions include:

• identifying, exposing and investigating corrupt conduct and police misconduct
• assessing police conduct
• ensuring the highest ethical and professional standards are maintained by police officers, and that police officers have regard to human rights set out in the Charter of Human Rights and Responsibilities Act 2006 (Vic)
• investigating complaints about corrupt conduct or misconduct of police
• undertaking education and prevention functions to achieve the objects of the IBAC Act.⁴⁷

Complaints, notifications and investigations

IBAC can conduct investigations in response to complaints from members of the public, notifications from Victoria Police or on its own motion.⁴⁸ IBAC can also receive public interest disclosures about police, sometimes known as ‘whistle-blower complaints’. These are assessed by IBAC and the complainant may be afforded protections under the Public Interest Disclosures Act 2012 (Vic).⁴⁹

On receiving a complaint or notification, IBAC assesses whether the matter should be referred to Victoria Police for internal action, investigated by IBAC or dismissed.

While IBAC must give priority to the investigation and exposure of serious and systemic corruption, it has the discretion to investigate any corrupt conduct or police misconduct.⁵⁰ In practice, IBAC ‘primarily investigates police matters that involve serious, systemic and/or sensitive allegations, and which [it has] the capacity and capability to best handle’.⁵¹

In its 2018 Inquiry into the external oversight of police corruption and misconduct in Victoria, the IBAC Committee of the Victorian Parliament (IBAC Committee Inquiry) described the system for handling complaints and disclosures about police as ‘extremely complex’.⁵² The IBAC Committee noted that the vast majority of complaints are referred back to Victoria Police for investigation.⁵³ Where this occurs, IBAC receives and monitors the outcomes.⁵⁴ IBAC also reviews a sample of internal investigations to ensure that they were handled appropriately and audits Victoria Police’s complaint-handling system.⁵⁵

Approaches to external oversight of the use of human sources in Australia

In Victoria, no external oversight agency has a specific, legislated function to oversee Victoria Police’s or other agencies’ use and management of human sources.

Under IBAC’s broad mandate to oversee Victoria Police’s integrity, IBAC could examine Victoria Police’s use of human sources if:

• it was the subject of a complaint, notification or disclosure; or
• IBAC initiated an own motion investigation into suspected serious or systemic police misconduct or corruption regarding the use of human sources.⁵⁶

Similarly, the VI could investigate suspected or alleged improper use of human sources by IBAC if it fell within its general jurisdiction to investigate and assess the conduct of IBAC and its officers.

The Commission consulted with nine police oversight agencies in other Australian jurisdictions during its inquiry. A list of the oversight agencies consulted can be found at Appendix G.

Consistent with the current approach in Victoria, these Australian agencies do not have specific functions to oversee the use of human sources by police. Like IBAC, agencies can generally investigate matters relating to the use of human sources as part of their broader police integrity functions.⁵⁷ For example, some oversight agencies have investigated allegations of improper conduct by police in their use of human sources, such as corrupt relationships with sources or the provision of inappropriate financial rewards to sources.⁵⁸

The Commonwealth Inspector-General of Intelligence and Security (IGIS) oversees six national intelligence agencies, including the Australian Security Intelligence Organisation (ASIO) and Australian Secret Intelligence Service. IGIS monitors agencies’ operational activities through regular inspections, and reviews human source management processes to ensure agencies act legally and with propriety, comply with ministerial guidelines and directives, and respect human rights.⁵⁹ For example, IGIS reviewed ASIO human source case files in 2018–19 and met with ASIO staff to discuss related activities.⁶⁰

Approaches to external oversight of the use of human sources internationally

The Commission understands that, with the exception of the Investigatory Powers Commissioner’s Office (IPCO) in the United Kingdom and certain federal agencies in the United States of America, oversight agencies in comparable countries do not have specific functions to oversee the use of human sources by police services. As is the case in Australia, these agencies could examine the use of human sources as part of their broader complaint-handling,⁶¹ inspection⁶² and audit jurisdictions.⁶³

As noted in Chapter 12, the Commission paid particular attention to the United Kingdom’s legislative and external oversight framework for human source management due to the specific requirements in place for the use of human sources and the similarities between the legal and human rights systems of Victoria and of the United Kingdom.

Investigatory Powers Commissioner’s Office, United Kingdom

In the United Kingdom, IPCO provides external oversight of public authorities’ use of investigatory powers, including their use of human sources. Public authorities are defined to include police services. IPCO consists of the Investigatory Powers Commissioner, a team of Judicial Commissioners and IPCO staff.⁶⁴ Chapter 12 outlines the regulatory framework for public authorities’ use of investigatory powers in the United Kingdom. This chapter focuses on the aspects of this regulatory framework that are relevant to external oversight.

Oversight by the Investigatory Powers Commissioner’s Office and Commissioner

Among IPCO’s oversight functions under the Investigatory Powers Act 2016 (UK) (Investigatory Powers Act) is the requirement to review—by audit, inspection or investigation—public authorities’ exercise of functions relating to human sources under the Regulation of Investigatory Powers Act 2000 (UK) and their adherence to the practices and processes prescribed in the Covert Human Intelligence Sources Revised Code of Practice (Code of Practice).⁶⁵ IPCO can undertake inspections on its own initiative or it can be asked to investigate a specific issue by the Prime Minister. It can also produce guidance to public authorities on the use of investigatory powers.⁶⁶

The Investigatory Powers Act also gives IPCO powers to discharge its oversight functions.⁶⁷ The Code of Practice notes that the Investigatory Powers Commissioner ‘will have unfettered access to all locations, documentation and information systems as are necessary to carry out their full functions and duties’.⁶⁸

Public authorities are required to keep detailed and extensive records relating to the registration and use of human sources.⁶⁹ This includes records about:

• a human source’s identity
• the officers responsible for managing the source
• the tasks given and demands made of the source
• all contacts and communications between the source and the authority
• the information obtained and disseminated
• any payment, benefit or reward given or offered to the source
• copies of key documents, including registrations, reviews, renewals and risk assessments.

The Commission consulted with IPCO and understands that:

• On-site inspections of law enforcement agencies generally occur annually, though there may be more frequent inspections of larger public authorities.
• Following an inspection, IPCO provides the agency with a report identifying any areas of legal non-compliance, its recommendations and any broader observations, drawing attention to relevant legislation and any other available guidance.
• If any ongoing compliance issues are observed, IPCO may conduct a focused revisit.
• While focusing on compliance, IPCO also considers authorities’ internal policies and processes and shares information with them about good practice.⁷⁰

Public authorities can seek general advice from the Investigatory Powers Commissioner about any issue that falls within the Commissioner’s responsibilities as regards to the law and the applicability of investigatory powers, though IPCO does not issue formal advice on operational decisions given the critical need to maintain its independence from the authorities it oversees.⁷¹

Approval of a Judicial Commissioner

In the United Kingdom, there are enhanced registration procedures where a public authority intends to use a human source to obtain, provide access to or disclose knowledge of legally privileged material.⁷² Where the public authority is a law enforcement agency, an IPCO Judicial Commissioner must approve the use of a human source in these circumstances.⁷³

The legal test for registration of a human source in these circumstances is also stricter. In addition to the normal considerations of proportionality and necessity, as discussed in Chapter 12, an IPCO Judicial Commissioner can only approve the registration of a human source in these circumstances if there are reasonable grounds for believing it is necessary on grounds of national security, the prevention or detection of serious crime, or the economic wellbeing of the United Kingdom.⁷⁴

The Code of Practice states that registration of a human source for these purposes should only be sought in ‘exceptional or compelling’ circumstances:

Circumstances which can be regarded as ‘exceptional and compelling’ will only arise in a very restricted range of cases, where there is a threat to life or limb or in the interests of national security. The exceptional and compelling test can only be met when the public interest in obtaining the information sought outweighs the public interest in maintaining the confidentiality of legally privileged material, and when there are no other reasonable means of obtaining the required information.⁷⁵

Requirement to report relevant errors relating to the use of a human source

Under the Investigatory Powers Act, the Investigatory Powers Commissioner must report any ‘relevant error’ to an affected person if the Commissioner thinks it is a serious error (that is, one causing significant prejudice or harm to the person concerned) and it is in the public interest to do so.⁷⁶

A ‘relevant error’ is an error in complying with any requirement of an Act that is subject to review by an IPCO Judicial Commissioner or an error described in the Code of Practice.⁷⁷ Examples of a relevant error include the use of a human source without lawful authorisation, and non-adherence to the safeguards in relevant legislation and the Code of Practice.⁷⁸

Relevant errors must be reported ‘as soon as reasonably practicable’ and no later than 10 working days after they are identified (or in such other timeframe as agreed with the Investigatory Powers Commissioner) along with:

• information on the cause of the error
• the human source’s activities
• how any material obtained from the human source is being managed
• a summary of the steps taken to prevent recurrence of the error.⁷⁹

The Investigatory Powers Tribunal, United Kingdom

The Investigatory Powers Tribunal in the United Kingdom can consider and investigate complaints about law enforcement agencies’ use of certain investigatory powers, including human sources. Members of the public can make a complaint if they believe they are a victim of unlawful action, or that their rights have been breached by any unlawful activity or a contravention of the Human Rights Act 1998 (UK).⁸⁰ For example, in 2019, the Tribunal heard a case concerning the legality of an intelligence agency’s policy in respect of human sources who participate in criminality.⁸¹

Challenges and opportunities

This section discusses key issues identified by the Commission and raised by stakeholders regarding external oversight of the use and management of human sources in Victoria, including:

• opportunities for external oversight of Victoria Police’s use and management of human sources
• potential models of external oversight that might be suitable
• key features of an effective external oversight framework
• opportunities for the alignment of any new external oversight model with Victoria’s current police oversight system.

These topics are discussed in turn below.

Opportunities for external oversight of Victoria Police’s use of human sources

Benefits of external oversight

As noted in Chapters 11 and 12, recent internal audits and historical external and internal reviews have identified non-compliance among some Victoria Police officers with the organisation’s human source management policy and procedures.⁸²

A broad consensus emerged from evidence and information provided to the Commission that external oversight is needed for the use and management of human sources by Victoria Police, although views on the most appropriate model differ. In summary, there was broad agreement that external oversight would:

• encourage compliance with legal and policy requirements for the registration and use of human sources
• raise policing standards, including by assisting police to balance competing public interests and make ethical decisions
• mitigate risks to Victoria Police, human sources and the criminal justice system
• support transparency and improve community confidence in Victoria Police’s use of human sources
• address a gap in Victoria’s current oversight system, noting that other covert police powers and methods are subject to external oversight.

IBAC told the Commission:

There is a significant gap in the present oversight system in respect to Victoria Police’s registration and use of human sources. It is concerning that this area of covert operation by all Victorian law enforcement bodies (including IBAC) is currently not subject to any express statutory oversight.

…

IBAC also considers that the management of human sources, as with other areas of covert and intrusive operations, is strengthened by oversight by an independent body or bodies.⁸³

This sentiment was shared by the International Commission of Jurists Victoria, which referred to the covert nature of human source management and suggested that Victoria Police has long exercised broad discretionary powers without external oversight to act as a check and balance against the improper use of such powers.⁸⁴

Some members of Victoria Police Executive Command also saw merit in external oversight as a means of encouraging compliance and helping police balance competing public interests.

Deputy Commissioner Wendy Steendam, APM, Specialist Operations, told the Commission, ‘Victoria Police agrees that external oversight may be appropriate for the registration, use and management of human sources who have a legal obligation of privilege or confidentiality’.⁸⁵ In her statement to the Commission, Ms Steendam noted that ‘the benefits of external oversight are clear and supported by Victoria Police’, pointing to the role it can play in supporting Victoria Police’s compliance with legal requirements and internal policy.⁸⁶

Assistant Commissioner Thomas (Luke) Cornelius, APM told the Commission that he has long been a ‘strong advocate for independent oversight’. He explained:

… the best disinfectant … is daylight and I just think in fraught areas such as these … that [an] open and transparent framework that might support the balancing of potentially competing public interest considerations would be of significant benefit to us, and independent oversight is a very healthy way of supporting that process.⁸⁷

Dr John Buckley, former police officer and now a provider of human source training and consultancy services, told the Commission that external oversight in the United Kingdom has raised standards and helped police services mitigate risk. Dr Buckley noted that IPCO’s role:

… had a positive impact on raising policing standards and ensuring that senior officers pay attention to their directions … From a police perspective, it protects the organisation from damage, offers an advisory and objective perspective and provides independent oversight.⁸⁸

The VI told the Commission that external oversight would support ethical decision making, manage risk, and promote public confidence in Victoria Police’s use of human sources:

… an ethical perspective on the use of human sources, as well as an objective to control the serious risks involved in those activities, would favour ongoing external oversight …

Victorians might reasonably expect that police activities that generate these risks should be subject to ongoing external oversight. Beyond any expectation in usual circumstances, the events that have led to the Royal Commission require public confidence in Victoria Police’s use of human sources to be repaired. The VI suggests that this can only be achieved by some form of external oversight.⁸⁹

Professor Alexandra Natapoff, University of California, told the Commission that ‘transparency and external oversight are key’ to the use of human sources and that ‘it is not sufficient for mechanisms to better regulate the use of [human sources] to be triggered by an exceptional event; they should be routine’.⁹⁰ Similarly, Mr Arthur Moses, SC, former president of the Law Council of Australia, considered that oversight agencies ‘should, if they do not already, conduct annual audits of the human sources used by law enforcement agencies’.⁹¹

The Law Council of Australia, noting the High Court of Australia's decision regarding Victoria Police’s use of Ms Gobbo as a human source, highlighted ‘the need for strong and properly resourced oversight bodies to supervise the activities of law enforcement’.⁹² In a submission to the Commission, Victoria Legal Aid suggested the Commission should recommend stronger transparency, accountability and external oversight mechanisms to ensure that, as a starting point, legal practitioners (or those in similar occupations) are not used as human sources and are only used in exceptional circumstances with the endorsement of an independent oversight body.⁹³

Concerns about external oversight

Some stakeholders expressed concerns that an external oversight regime may undermine the effectiveness of police services’ use of human sources in the prevention, detection and investigation of criminal activity.

As noted in Chapter 12, most Australian law enforcement and intelligence agencies told the Commission they have robust internal governance and oversight mechanisms in place to mitigate the risks associated with the use and management of human sources. Some of those agencies expressed concerns that a legislative framework—which would be required to facilitate external oversight—may compromise the operational flexibility and efficiency required for effective policing.

The Australian Institute of Policing told the Commission that Victoria Police’s current processes for human sources with legal obligations of confidentiality or privilege are ‘adequate and effective’, noting the changes to these processes since the use of Ms Gobbo as a human source.⁹⁴

Ms Steendam told the Commission there are risks associated with external oversight:

The main risk is that the sharing of any information about human sources makes it more likely that the identity of the human source will become known. In turn, the prospect of information about a human source being made known to an oversight body may need to be disclosed to a potential human source. This risks creating a chilling effect [in that it discourages this human source and others from providing information to police for fear for their safety]. Victoria Police would support safeguards to limit the nature of any information about a human source provided to that which is genuinely needed.⁹⁵

In contrast, Professor Sir Jonathan (Jon) Murphy, QPM, DL, Liverpool John Moores University, told the Commission that, in his experience, the potential disclosure of human source identities or information to IPCO in the United Kingdom has not deterred people from becoming human sources.⁹⁶

Stakeholders suggested that the following factors can create and strengthen positive relationships between law enforcement and oversight agencies to help overcome concerns:

• law enforcement and oversight agencies working collaboratively on implementation of the oversight regime⁹⁷
• oversight agencies having robust security arrangements in place for handling sensitive information⁹⁸
• oversight agencies adopting an open, transparent and constructive approach with law enforcement agencies during inspections or audits⁹⁹
• oversight agencies seeking to understand the law enforcement agency’s operational objectives and operating environment.¹⁰⁰

Scope of external oversight

The Commission heard differing views on the appropriate scope of any external oversight regime for the use of human sources by Victoria Police—in terms of both the categories of human sources and the aspects of the police–human source relationship that should be subject to oversight.

Victoria Police submitted that external oversight should have a narrow application, limited to human sources with legal obligations of confidentiality or privilege:

Victoria Police does not consider that there is good evidence to support extending external oversight to other categories of human sources, given the level of internal governance and oversight, the risks to those sources and the fact that no issues have been identified that would justify such oversight.¹⁰¹

IBAC told the Commission that oversight should be tailored to risk, with more ‘intensive oversight where it is going to be most effective’.¹⁰² According to IBAC, this could involve compliance monitoring and outcome reporting for all human sources used by Victoria Police and, for high-risk, vulnerable and complex human sources, external involvement in decision making (including reviewing proposed registrations to ensure they are appropriate and justified) and the capacity to review and make recommendations on relevant decisions.¹⁰³ IBAC also suggested that high-risk human sources who should be subject to more stringent oversight include lawyers, medical professionals, journalists, Members of Parliament and clerics, along with children and people with an intellectual or other mental impairment or physical disability.¹⁰⁴ The VI suggested that high-risk human sources might also include people in particularly compromised situations due to their relationship with targets of Victoria Police’s investigations, and people with other forms of vulnerability.¹⁰⁵

In relation to the aspects of the police–human source relationship that should be subject to external oversight, Victoria Police advocated for limiting oversight to decisions about the registration of human sources and said that oversight of their subsequent use and management would require further consideration.

In a statement to the Commission, Ms Steendam noted:

There will be many operational decisions that should be properly left to Victoria Police, for example, how human sources are tasked, how their cover is managed and the like.¹⁰⁶

IBAC suggested that external oversight should involve access to comprehensive information about the police–human source relationship, including the recruitment and registration, tasking, length and scope of registration, and deregistration of human sources.¹⁰⁷

This appears to align with the United Kingdom approach. IPCO told the Commission that it assesses the following aspects of human source use and management:

• the recruitment process
• risk assessments
• the human source’s taskings and rewards, and details of any contact
• whether useful intelligence was gained from the human source
• the relationships between police officers who manage human sources
• training maintained by police officers who manage human sources
• internal oversight arrangements.¹⁰⁸

IPCO also told the Commission that it:

… looks particularly for evidence from the handler, controller and authorising officer, and at the documented decision making, to see that the key issues of necessity, proportionality, collateral intrusion and risk have been suitably addressed individually for each [human source].¹⁰⁹

Models of external oversight

Involvement in decision making to register human sources

As outlined above, Victoria Police must obtain external approval, usually from a judge or magistrate, to use a range of covert powers such as telecommunications intercepts and surveillance devices. Whether to register a human source, however, is an internal police decision.

The United Kingdom’s legislative regime requires an IPCO Judicial Commissioner to authorise the use of a human source from whom public authorities intend to obtain legally privileged information, in recognition of the important relationship between a lawyer and their client and the associated protections afforded to legally privileged information.¹¹⁰

Former police officer Dr Adrian James, Liverpool John Moores University, told the Commission that external involvement in law enforcement agency decisions about human sources is essential and can resolve the challenges that arise from purely internal registration processes, including that the applicant and the authorising officer are immersed in the same organisational cultures, values and behaviours and may share the same organisational goals.¹¹¹ Sir Jon told the Commission that the United Kingdom’s regime—including IPCO’s involvement in registrations—provides officers with a clear and consistent process for making challenging ethical decisions and gives them more confidence that they are making the right decisions.¹¹²

As noted earlier, some stakeholders told the Commission that, in certain situations, an external agency should be involved in decisions related to Victoria Police’s registration of human sources.

The VI suggested that ‘a proposal to recruit a high-risk source should trigger an external decision-making process, as in the [United Kingdom] model’.¹¹³ Victoria Legal Aid suggested that a lawyer should not be registered or used as a human source unless an external oversight agency can be satisfied that there is no risk of a breach of professional obligations.¹¹⁴

IBAC and the PIM suggested that, should external oversight of human sources be introduced, an external agency could review or test certain applications or proposed decisions when dealing with prospective or registered human sources with legal obligations of confidentiality or privilege. This would be similar to the role that the PIM plays in the witness protection regime, where Victoria Police is the final decision maker.¹¹⁵ IBAC also suggested this role could extend to other vulnerable and complex sources.¹¹⁶

The PIM noted that this involvement in decision making or ‘active oversight’ could be complemented by other mechanisms performed by a different agency, such as independent retrospective reviewing of Victoria Police’s decision making and/or monitoring of its compliance. The PIM suggested that active oversight would be most effective if it included involvement both in the decision to register a human source with legal obligations of confidentiality or privilege, and in the decision to disseminate any confidential or privileged information received.¹¹⁷

The PIM also noted it would probably be the most suitable agency to undertake this type of external oversight (that is, involvement in decision making or ‘active oversight’) due to:

• its extensive experience in testing applications for covert powers
• its operating hours (24 hours a day, seven days a week)
• its existing governance and security to manage highly sensitive information
• the success of its involvement in the witness protection regime, which could provide a model for any comparable involvement in Victoria Police’s decisions about the use and management of human sources with legal obligations of confidentiality or privilege.¹¹⁸

Victoria Police told the Commission it had considered a model in which the PIM would sit on the Human Source Ethics Committee, the internal decision-making body for certain high-risk sources, and provide ‘external advice’, but acknowledged that this would not constitute external oversight, which ‘should properly occur completely separately from Victoria Police, that is, not by membership of the decision making body’.¹¹⁹

As noted above, Victoria Police told the Commission that the design of any external oversight model must consider associated risks, explaining that sharing any information about a human source makes it more likely that their identity will become known. It cautioned that appropriate safeguards would be needed to manage this risk.¹²⁰ Victoria Police also stated that the current police oversight bodies may not currently have the expertise, operational knowledge and experience to oversee this specialised policing activity.¹²¹

In her evidence to the Commission, Ms Steendam explained that current internal decision-making processes within Victoria Police provide for registrations to occur more quickly in urgent circumstances, and noted that any external involvement in decision making would need to include processes for expediting registrations of human sources where it is appropriate to do so.¹²²

Review of decisions and monitoring compliance with the regulatory framework

As noted above, models for compliance monitoring and review of decisions in relation to the exercise of police powers in Victoria vary in form and intensity. The Commission heard different views about the utility of this type of oversight generally, and about the approach that could be adopted in any external monitoring of Victoria Police’s use of human sources.

Some stakeholders emphasised the importance of monitoring an agency’s records to assess compliance with legislative and regulatory requirements. IBAC told the Commission that this is a ‘powerful tool in ensuring transparency and rigour’ and that it requires engagement and consultation between the oversight and law enforcement agency, which can in turn drive positive organisational change.¹²³ The VI noted that external oversight involving inspections is effective where proper record keeping strongly encourages compliance with the substantive aim of a legislative requirement, such as prohibitions on, or permissions for, the use and communication of information. The VI said such an approach is particularly suitable where the actions being tested are performed using systems, such as telecommunications interception activities.¹²⁴

Sir Jon identified several benefits arising from law enforcement agencies in the United Kingdom being subject to compliance inspections by IPCO and its predecessor, including:

• objective external scrutiny by experienced inspectors
• reducing the chance of poor and unprofessional record keeping
• providing a means of learning through analytical examination of the law enforcement agency’s registrations to use human sources.¹²⁵

Compliance monitoring can, however, have limitations. The IBAC Committee Inquiry noted that compliance-monitoring legislation often limits oversight bodies to assessing only whether an agency is acting in accordance with the law, rather than assessing how agencies perform their functions or directly examining its policies and procedures.¹²⁶ The VI suggested that inspection of a limited set of records may not reveal systemic or significant breaches of the law, particularly breaches that result from, or are enabled by, actions that are not required to be documented in that set of records.¹²⁷

Sir Jon also highlighted the difficulties an oversight agency can encounter in assessing whether a law enforcement agency’s formal records reflect operational practice. He explained that:

… understanding what lies beneath the formal records is a continual challenge, not just for authorising officers but for wise and discerning independent regulators as well.¹²⁸

As noted earlier in this chapter, IBAC’s role in relation to firearm prohibition orders provides an example of a more intensive form of monitoring that extends beyond whether records have been kept adequately, to whether police decisions made about the exercise of their powers are appropriate and justified.

The Firearms Act gives IBAC a broad remit to monitor Victoria Police’s use of powers and the performance of its duties and functions relating to firearms prohibition orders.¹²⁹ It requires IBAC, among other things, to review a sample of firearm prohibition orders each quarter and determine whether each order should have been made, having regard to the statutory criteria for making such orders and the information considered in making the order.¹³⁰ The Firearms Act also empowers IBAC to recommend any action it considers appropriate in relation to a reviewed order and requires the Chief Commissioner of Victoria Police to give a written response to that recommendation within 45 days.¹³¹ It also requires IBAC to include in its annual report:

• the number of firearm prohibition orders it has reviewed
• the number of such reviews where it recommended action to the Chief Commissioner
• the number of recommendations the Chief Commissioner accepted (and, by implication, rejected).¹³²

This arrangement seeks to balance the public interest in protecting police intelligence and methodology with the public interest in assuring the community that such orders, which limit the rights of those subject to them, are appropriate and justified.

Some compliance-monitoring regimes for the use of human sources also appear to have a broader scope than inspecting and reporting on record keeping:

• In the United Kingdom, IPCO monitors compliance with legislative requirements and other applicable guidance, including assessing the quality of human source management documentation and a law enforcement agency’s assessment of necessity and proportionality.¹³³
• In Australia, IGIS monitors intelligence agencies’ human source management processes to ensure the agencies act legally and with propriety, comply with ministerial guidelines and directives, and respect human rights.¹³⁴

External review of the appropriateness of police decisions and the related use of their powers and functions is a more in-depth form of compliance monitoring than records inspection. It is, however, a more time and resource intensive model and requires greater understanding of the various legal, operational and procedural factors relevant to decisions made.

The Commission heard that the timing, as well as the form of compliance monitoring is relevant to its effectiveness in holding police to account. For example, Victoria Legal Aid submitted that stronger, external oversight of Victoria Police’s use of human sources should include oversight that occurs in ‘real time’ as investigations proceed, arguing that this would promote transparency and accountability.¹³⁵ Others have suggested that retrospective oversight is ‘likely to be less rigorous than prior scrutiny’ (that is, real-time oversight) and that it is easier for a law enforcement agency to prove that powers have been used appropriately during a retrospective inspection, once it has already obtained relevant evidence or intelligence from the use of those powers.¹³⁶

Reviewing and investigating complaints

Some stakeholders told the Commission that where there is no dedicated external oversight of the use of human sources by police services, oversight bodies should have jurisdiction to deal with complaints about police actions or decisions related to human sources (including, for some oversight agencies, own motion powers). In this context, Dr Adrian James emphasised that an independent complaints mechanism is an essential element of any oversight regime.¹³⁷

However, the Commission also heard that there are limitations to a model of external oversight of police use of human sources that relies entirely on complaints. IBAC told the Commission:

It is highly unlikely that persons adversely affected by Victoria Police’s decisions or conduct in this highly covert area of operation would complain to IBAC (or any other agency) about any potential police misconduct, due to the secrecy and high level of risk to personal safety that is inherent in the human source relationship with law enforcement officers and bodies. In IBAC’s view, this reality only makes external oversight over the management of human sources by Victoria Police all the more critical.¹³⁸

Features of an effective external oversight model

This section outlines evidence before the Commission about the functions, powers and capabilities an oversight agency would need in order to provide effective external oversight of Victoria Police’s use of human sources, if such a regime were introduced.

Powers and governing framework

As outlined earlier in the chapter, external oversight arrangements for many Victoria Police powers and functions are set out in legislation. This ensures that the scope of oversight functions and powers, and corresponding police obligations, is clear. This is also the case in relation to oversight of human sources in the United Kingdom, with IPCO’s functions and powers set out in the Investigatory Powers Act.

The Commission’s review of relevant legislative regimes in Victoria and elsewhere indicated that the key elements of a legislative framework for external oversight are:

• a clear statement of the objectives of the oversight regime
• a clear statement of the oversight agency’s functions and duties
• adequate powers for the oversight agency to perform its functions
• a corresponding obligation for Victoria Police and its officers to cooperate and assist the oversight agency
• an ability for the oversight agency to report on its work and make recommendations to Victoria Police
• the public release of reports, with sensitive information likely to jeopardise any person’s safety, an investigation, a prosecution or national security, excluded.

An oversight agency’s objectives, functions and duties

Clearly setting out an oversight agency’s objectives, functions and duties in legislation is important to:

• provide clarity to the agency and Victoria Police
• support transparency to the public
• ensure, to the extent possible, consistency in approach with the oversight regime for other covert powers exercised by Victoria Police.

Broadly, the functions of existing oversight agencies are outlined in similar terms across statutory oversight regimes in Victoria.

For example, the Public Interest Monitor Act 2011 (Vic) outlines the PIM’s role in applications for police to use a range of covert and intrusive powers.¹³⁹ Similarly, the legislative regimes that enable the use of specific covert and intrusive powers and methods also set out the PIM’s role.¹⁴⁰

In the case of IBAC’s and the VI’s compliance-monitoring roles, common functions include:

• monitoring compliance with legislative requirements (with varying scope and intensity)
• conducting inspections
• in some cases, reviewing decisions and actions
• providing reports and, in some cases, making recommendations relating to the exercise of its functions.¹⁴¹

An oversight agency’s powers and Victoria Police’s obligations to assist

Oversight agencies have similar types of powers across the various oversight regimes.

The PIM, in fulfilling its functions to test police applications or to inform police decisions, generally has the power to appear at hearings, access relevant records and/or ask questions and make submissions.¹⁴²

Similarly, to fulfil their compliance-monitoring functions, the VI and IBAC generally (with some variations in the details) have powers to:

• enter premises of the law enforcement agency, after giving notice¹⁴³
• access records, including to take copies and extracts¹⁴⁴
• request relevant officers to give information, and/or attend before an inspecting officer and answer questions.¹⁴⁵

Victoria Police has corresponding legislative obligations to assist oversight agencies in the performance of their functions, including:

• in relation to the PIM, an obligation to notify the PIM of a relevant application and provide copies of the application and of supporting material, along with copies of material that is adverse to the approval of the application¹⁴⁶
• in relation to the VI and IBAC, an obligation to assist the agency in discharging its compliance-monitoring functions.¹⁴⁷

Victorian oversight agencies told the Commission that powers to access law enforcement agencies’ records and databases are critical to effective external compliance monitoring.

The VI identified the ‘lack of access to information regarding the operational context for oversighted activities’ as one of the challenges facing oversight agencies.¹⁴⁸ IBAC cautioned that while a prescriptive legislative inspection regime may be useful in defining an oversight agency’s inspection functions, it would not be advantageous to provide an exhaustive list of materials that it may request.¹⁴⁹

This sentiment was echoed during the Commission’s consultations with agencies from interstate and international jurisdictions. For example, IPCO told the Commission that, under its legislative framework, it has unfettered access to all human source records and databases during inspections. It explained that it:

… also has access to any associated [documents] used to record decisions and information falling outside the statutory considerations, which are viewed to enable deeper insight of how the [human source] is being operationally utilised and managed.¹⁵⁰

Similarly, Western Australia’s Corruption and Crime Commission noted that it has undertaken reviews of Western Australia Police’s use of human sources and was granted access to the police human source management database, including working expenses, rewards, letters of recognition, policy logs and critical decision logs. This allowed it to review police communications with each human source, where necessary.¹⁵¹

At the Commonwealth level, IGIS is empowered to inquire into any matter relating to ASIO’s compliance with publicly available guidelines, which are issued by the Minister for Home Affairs under sections 8A(1) and 8A(2) of the Australian Security Intelligence Act 1979 (Cth). To facilitate this, the guidelines require ASIO to ensure that IGIS and its authorised staff have effective access to all information held by ASIO (including relevant policies and procedures) and can retain information required to demonstrate its propriety and compliance with applicable laws.¹⁵²

In terms of obligations on police, the Commission heard that it would be important for any external agency to ‘be supported by powers to require Victoria Police officers to provide assistance to the oversight body in the exercise of its monitoring functions’.¹⁵³

Reporting requirements and recommendation-making powers

The Commission heard from a range of stakeholders about the reporting and recommendation-making powers and functions of external oversight agencies.

External oversight regimes in Victoria generally involve public reporting, with key features relating to:

• Frequency—compliance-monitoring reports are usually required annually, but under some regimes, the oversight agency can make special reports where it considers it necessary and/or at the request of the responsible Minister.¹⁵⁴
• Content—generally, reports must cover the compliance or performance of the agency subject to oversight as well as the performance of the external oversight agency.
• Recipient—generally, the recipient is the responsible Minister and sometimes a copy is provided to the Chief Commissioner or Parliament.
• Tabling in Parliament—some legislative regimes specify that reports must be tabled in Parliament.¹⁵⁵
• Vetting—mechanisms exist to remove from the report information that may endanger a person, prejudice a prosecution or compromise an investigation or methodology, before any public release of the report.¹⁵⁶
• Recommendations—some regimes have specific provisions for the external oversight agency to make recommendations relating to the exercise of its functions.

The Commission heard that public reporting of compliance offers advantages including greater accountability and transparency in otherwise opaque areas of law enforcement practice, promoting community confidence in law enforcement agencies’ practices, and informing the public about whether an agency is implementing necessary reforms or recommendations.¹⁵⁷ Sir Jon also noted that publishing an oversight agency’s annual reports is a means to spread best practice.¹⁵⁸

Some stakeholders stressed the need to ensure that public reporting does not expose human sources to increased safety or security risks, reveal law enforcement agencies’ operational processes, or impose an unnecessary administrative burden.¹⁵⁹ IBAC, for example, noted that a public report might need to contain less detail than the reports provided in private to Victoria Police, to ensure the protection of sensitive police information.¹⁶⁰

The Commission also heard from stakeholders regarding the ability of external oversight agencies to make and enforce recommendations.

IBAC told the Commission that the legislative power for external oversight agencies to make recommendations is most effective if accompanied by the power to require Victoria Police to act on, or respond to, those recommendations.¹⁶¹ The VI told the Commission that, while engagement can be an effective way to encourage implementation, the ability to require Victoria Police to report on implementation within a reasonable timeframe would also be beneficial.¹⁶²

The power to direct or recommend action, including within specified timeframes, is not without precedent in Victoria’s oversight regimes. For example:

• The judge or magistrate responsible for issuing a surveillance device warrant ‘may order any information obtained from or relating to the execution of the warrant or any record of that information be dealt with in the way specified in the order'.¹⁶³
• The PIM may make recommendations to the Chief Commissioner about matters arising from the PIM’s functions under the Witness Protection Act 1991 (Vic) and the Chief Commissioner must take the recommended action within a reasonable period or provide a written explanation to the PIM as to why that action has not or will not be taken.¹⁶⁴
• After reviewing a firearm prohibition order to determine whether or not it should have been issued, IBAC may recommend to the Chief Commissioner that certain action should be taken and the Chief Commissioner must respond to that recommendation in writing within 45 days.¹⁶⁵ Additionally, IBAC is required to record how many recommendations it has made and how many the Chief Commissioner has accepted in IBAC’s annual report.¹⁶⁶

Organisational capability and relationships

While the knowledge, experience and capabilities required by an external oversight agency’s personnel depends on the agency’s specific functions and powers, some stakeholders shared their views with the Commission about the broad capabilities that an oversight agency should have if it were responsible for overseeing the use of human sources. This included, for example, an understanding of the operating context in which human sources are engaged to gather intelligence and information.¹⁶⁷

The International Commission of Jurists advocated for a judicially led oversight commission for human source management in Victoria similar to the United Kingdom’s model, where IPCO consists of the Investigatory Powers Commissioner and a team of Judicial Commissioners.¹⁶⁸ Dr Buckley, former police officer in the United Kingdom, noted that one of the benefits of having judicial officers involved in the process of registering human sources is they ‘ask the right questions’.¹⁶⁹

The VI noted the importance of oversight agencies understanding, or having experience in, law enforcement functions.¹⁷⁰ It submitted that oversight agency personnel could be seconded to Victoria Police in the early stages of implementation to ‘learn its systems, operational context, and contribute to its procedural development’.¹⁷¹ The VI also told the Commission that it relies on good working relationships with Victoria Police to develop operational knowledge, which can otherwise be difficult to obtain.¹⁷²

The United Kingdom Home Office told the Commission that police respond positively when oversight agencies take a pragmatic approach that shows understanding of operational requirements and pressures.¹⁷³ IPCO echoed this, noting that its Judicial Commissioners sometimes accompany inspectors to interact with agencies and obtain a clearer understanding of the operational practices related to activities they oversee. IPCO also told the Commission that before finalising inspections, it meets face-to-face with the handling team and senior officers to discuss its proposed findings, areas for improvement and positive feedback. In addition, as part of its commitment to fostering best practice human source management, IPCO attends training and other forums with public authorities and informs officers of the importance of legislative compliance and IPCO’s role and functions.¹⁷⁴

Stakeholders told the Commission that it is important for oversight agencies to have an open, collaborative and educative relationship with the agencies they oversee, but also stressed that maintaining the oversight agency’s independence is critical.¹⁷⁵ For example, as noted earlier, while public authorities can seek general advice from IPCO on issues that fall within its legislative remit, it will not issue formal advice about specific operational decisions or issues, which could compromise or otherwise conflict with its independent oversight role.¹⁷⁶

Security arrangements

The Commission heard that it is essential for external oversight agencies to have robust security arrangements in place to handle sensitive and confidential information, such as information about or provided by human sources. For instance, strong security arrangements are required for similar covert methods and functions so that oversight bodies have appropriate access to databases and records, while also protecting the integrity and security of police investigations and the safety of members of the public they involve.¹⁷⁷ Ms Steendam noted the PIM and VI’s current oversight of Victoria Police already navigate the sensitivities and issues associated with these similar methods.¹⁷⁸

The PIM told the Commission that robust security arrangements could include appropriate clearances for staff and secure environments to store information.¹⁷⁹ The VI expressed similar views, adding that ‘proper resourcing is pivotal, not just of inspection staff, but also of infrastructure and security—information management, personnel integrity, security vetting processes’.¹⁸⁰ The VI also observed the long lead times for security vetting for certain clearance levels for staff and suggested that setting and obtaining the appropriate clearance levels must be factored in to implementation timeframes for any external oversight regime.¹⁸¹ Likewise, IBAC explained that due to the risk associated with additional agencies and individuals learning of the identity of a human source, external oversight should be clear, contained and safeguarded through appropriate processes and security settings.¹⁸²

The Commission also notes that information security can be built into legislative and regulatory frameworks. For example, both the Surveillance Devices Act 1999 (Vic) and Witness Protection Act require the PIM to return certain materials to police once it has fulfilled its functions.¹⁸³

Alignment with Victoria’s current police oversight system

The Commission is mindful that it is desirable for any external oversight of Victoria Police’s use of human sources to fit within Victoria’s existing police oversight system, rather than introducing yet another body in an already crowded space.

This section outlines the challenges posed by the existing oversight framework, and opportunities to streamline police oversight in Victoria.

Benefits of the current framework

The Commission heard that there are some benefits in dispersing police oversight functions across multiple agencies. For example, the VI noted that the current system:

• develops specialised knowledge and entities
• enables oversight entities to focus on their specific functions
• largely avoids conflicts of interests that could arise either from an agency overseeing powers it can also use, or from an agency reviewing or investigating a matter it had previously been involved in through its decision-making function
• provides consistent, system-wide oversight of a specific covert or intrusive power; for example, the VI oversees five agencies’ use of controlled operations.¹⁸⁴

IBAC noted that the VI and PIM’s oversight functions and powers complement its own oversight functions and powers. Further, it observed that this ‘tiered approach to oversight (or separation of roles between oversight bodies) strengthens the impartiality and independence of each agency by avoiding the centralisation of power in a single agency’.¹⁸⁵

Shortcomings of the current framework

The Commission also heard that the current oversight framework has shortcomings; specifically, that the institutional framework can cause duplication and fragmentation, and that legislation takes an inconsistent approach to oversight functions, powers and obligations.

IBAC told the Commission that the current system:

… contains elements of fragmentation caused by a lack of role clarity around some areas of oversight, as well as inconsistencies in the type and level of oversight exercised by each agency. Broadly, this reflects a lack of [a] cohesive framework based on established oversight principles, the expansion of law enforcement powers and the ad hoc development of the integrity system as a check and balance on those increasing powers. Further, there are jurisdictional overlaps with the Commonwealth Ombudsman who has oversight of telecommunications interceptions along with VI. Different approaches are taken by different agencies to oversight often making it more onerous to meet or reconcile approaches.¹⁸⁶

IBAC stated that the lack of an overarching policy framework has the following consequences:

• difficulties and inefficiencies for Victoria Police in implementing a planned response to compliance oversight and risk management
• dispersed effort across a range of agencies that undermines consistent, proportionate and planned compliance monitoring geared towards prevention and capability building
• a lack of transparency and consistency, alongside increased risks of monitoring [gaps], that undermines public confidence in the oversight of covert and intrusive powers of Victoria Police.¹⁸⁷

The VI also identified potential challenges with the current framework, including that it:

• may not provide an overall picture across the system or identify systemic problems
• may pose challenges for identifying and assessing connections between the use of different powers or activities
• may lead to the application of inconsistent oversight methodologies
• risks being complicated or confusing in practice.¹⁸⁸

The VI pointed out that reporting obligations of oversight bodies are inconsistent, noting that ‘some Acts require public reports, some not, and the different Acts vary in their description of reporting obligations without clear reason’.¹⁸⁹ The Commission notes there are also inconsistencies in the prescribed content of reports, and in the VI and IBAC’s powers to monitor compliance.¹⁹⁰

The VI also commented on information-sharing difficulties, a view shared by the PIM, who stated that:

A disadvantage (perhaps inevitable) of this separation of functions is that it limits the scope for the sharing of information and experience that may be of interest to more than one agency.¹⁹¹

Streamlining oversight of investigatory powers

Given some of the shortcomings identified by stakeholders, the Commission considered the benefits and risks of streamlining or centralising oversight of certain covert powers used by Victoria Police.

IPCO told the Commission that its replacement of three predecessor agencies provided benefits including clarity, consistency and the ability to examine law enforcement agencies’ powers more holistically.¹⁹²

Victorian oversight agencies did not consider such an approach to be viable here. IBAC noted that while a centralised oversight model could provide a comprehensive response to the issues raised during the Commission, the creation of a new statutory entity is unnecessary because:

• a number of existing agencies already oversee Victoria Police’s use of covert and intrusive powers and functions
• the cost and complexity of creating a United Kingdom style model far outweigh the benefits when balanced against the risks
• much of the legislation governing controlled operations, assumed identities and witness protection is based on national model laws, making a single Victorian statutory framework regulating all covert and intrusive powers infeasible.¹⁹³

The VI agreed that consolidating oversight powers in one body is unlikely to be possible, given that relevant powers are contained in both state and Commonwealth legislation. However, the VI did identify potential advantages, noting that because existing legislation enables certain powers to be used together, consolidation would give the oversight body an overall picture of the use of covert and intrusive powers.¹⁹⁴

While stakeholders agreed that consolidation of oversight is not viable, some suggested that there is a need for greater consistency in the approach to the oversight of covert and intrusive powers in Victoria.¹⁹⁵ For example, IBAC told the Commission:

The development of a cohesive framework based on established principles that looks to the desired outcomes of police oversight in this context should exist to … guide policy and legislative reform that [harmonise] the current patchwork of agencies and laws. Such a framework would create a basis for a more targeted oversight program design which would support greater efficiency and effectiveness through consistency, proportionality and responsiveness of oversight activity that prevents and detects risks and non-compliance.¹⁹⁶

Conclusions and recommendations

Based on stakeholder views and other evidence obtained during its inquiry, the Commission concludes that the police oversight system in Victoria would be strengthened by establishing a dedicated external oversight regime for Victoria Police’s use and management of human sources.

The Commission considers there are compelling reasons for such external scrutiny, including the potential intrusiveness of and inherent risks in the covert nature of human source management; and the need for greater accountability and transparency in Victoria Police’s use of human sources.

It recommends the establishment of a tiered external oversight model, with the nature and intensity of oversight aligned to the level of risk associated with the use of different human sources and the information they provide. It proposes that:

• The highest level of scrutiny should apply to Victoria Police decisions relating to the registration of ‘reportable human sources’ (that is, human sources who are reasonably expected to have access to confidential or privileged information). A final decision to register such a source should involve the PIM (Tier 1 oversight).
• External monitoring of Victoria Police’s legislative and regulatory compliance should apply to its use of all human sources and be conducted by IBAC (Tier 2 oversight).
• IBAC’s existing jurisdiction to investigate and oversee complaints about serious police misconduct or corruption, including in relation to Victoria Police’s use and management of human sources, should remain (Tier 3 oversight).

The Commission also considers that there may be merit in the Victorian Government undertaking a principle based review to bring greater coherence to the broader police oversight system, but notes that wholesale change is not warranted.

These conclusions and recommendations are discussed in turn below. The Commission also outlines key considerations regarding implementation of the proposed external oversight model, should this be introduced.

Introducing dedicated external oversight of Victoria Police’s use of human sources

Although the police oversight system in Victoria is more comprehensive now than when Ms Gobbo was a human source, there is still no legislated, external oversight regime for Victoria Police’s use of human sources. This is the case even though, like other covert and intrusive methods, the use of human sources poses risks to human rights, individuals and the administration of justice.

The Commission is persuaded by the view put by several stakeholders that the absence of dedicated oversight of Victoria Police’s use of human sources represents a significant gap in Victoria’s police oversight system. Reasons to fill this gap, as outlined in this chapter and elsewhere in this report, are as follows:

• The use of human sources is a critical tool to prevent, detect and solve crime, and is likely to be increasingly important in the future as the effectiveness of other investigative methods diminishes through technological change and the growing sophistication of criminal networks.
• Over 20 reviews in as many years, both internal and external to Victoria Police, have consistently identified human source management as a high risk for Victoria Police, along with evidence of non-compliance with human source management policies and procedures and, in some cases, corrupt or improper conduct among officers.
• IBAC’s jurisdiction to investigate police misconduct, triggered in large part by complaints or notifications, has limited utility given the covert nature of human source management and the unlikelihood of human sources, fearful for their and others’ safety, making a complaint.
• External oversight would encourage Victoria Police compliance with procedural requirements and enable issues to be identified and addressed at an earlier stage.
• The greater accountability and transparency that external oversight brings would help to restore public confidence in Victoria Police’s use of human sources.
• More broadly, external oversight would foster community confidence in Victoria Police and provide reassurance that it is not misusing its powers or infringing human rights.
• Given the covert nature of Victoria Police’s use of human sources, there is a risk that without dedicated external oversight, future aberrant conduct—such as that examined by this Commission—would not be reported to Victoria’s oversight agencies in a timely way.

The Commission acknowledges Victoria Police’s view that current internal governance arrangements provide adequate safeguards in all but the highest-risk cases (namely, human sources involving legal obligations of confidentiality or privilege), and further that external oversight raises security concerns and risks discouraging people from becoming human sources.

The Commission is unconvinced by the first point. It notes, for example, the historical and ongoing concerns about Victoria Police’s compliance with internal policies and procedures.

The second point requires careful attention in the design and implementation of the oversight model. The Commission draws comfort from evidence that external oversight of human sources in the United Kingdom does not appear to have affected the willingness of people to assist police¹⁹⁷ or to have led to the identities of human sources being leaked or becoming otherwise improperly known. In the Victorian context, there are also examples of mechanisms to ensure that external oversight of highly sensitive police work does not compromise individual safety and security, police methods, investigations or current prosecutions.

The Commission recommends that, to complement the legislative regime recommended and outlined in Chapter 12, the Victorian Government establishes a dedicated external oversight regime for Victoria Police’s use and management of human sources to:

• provide assurance to the Victorian Government, Victorian Parliament and community that Victoria Police is using and managing human sources in a manner that is appropriate, ethical and effective
• foster continuous improvement in Victoria Police’s human source management practices.

The Commission recommends that the external oversight regime be implemented within two years, recognising that the Government will need to consult with Victoria Police, Victorian oversight agencies and other relevant stakeholders, and further that it is desirable for the regime to commence at the same time as the commencement of the legislative framework for Victoria Police’s use of human sources, as recommended in Chapter 12.

A principle and risk-based external oversight model

The Commission heard that an oversight model should be underpinned by a clear set of principles. In Chapter 12, the Commission outlines a series of design principles to underpin its proposed human source management framework. Some of the principles articulated in that chapter are also relevant to the design of external oversight arrangements. For example, the Commission considers that any external oversight of Victoria Police’s human sources should be guided by:

• Necessity and proportionality—more intensive oversight should be applied to higher-risk human sources and/or information from human sources, balancing the public interest in police having workable tools to prevent, investigate and prosecute crime, with the public interest in ensuring that the use of such tools is necessary, proportionate and justified.
• Accountability—the framework should support Victoria Police being accountable for its decisions about human sources and provide transparency to the public around the administration of human source management.
• Effectiveness—oversight functions should not only facilitate technical compliance, but also contribute to ethical decision-making and use of human sources; and oversight agencies should have the powers, capabilities and resources to fulfil their functions effectively.
• Safety and sensitivity—the oversight model should achieve its objectives without compromising the safety of any individual, exposing sensitive police methods, or prejudicing investigations or prosecutions.
• Consistency—to the extent possible, the oversight framework for human source management should align with the broader police oversight system.

Overview of the proposed external oversight model

Figure 13.3 below summarises the tiered model for external oversight of Victoria Police’s use of human sources recommended by the Commission. It illustrates that the intensity of external oversight should be correlated to the level of risk involved in using a human source or the information they provide.

Figure 13.3: Proposed external oversight model for the use of human sources by Victoria Police

The Commission recommends that Tier 1 oversight be limited to the proposed registration of human sources who are reasonably expected to have access to confidential or privileged information (referred to by the Commission as ‘reportable human sources’).

This would allow for independent input in Victoria Police’s decisions about the use of human sources in circumstances where there are greater risks to the administration of justice—that is, where the use of a human source could result in a prosecution being withdrawn, a trial being stayed or a conviction overturned.

The Commission considers that Tier 2 oversight should apply to all human sources used by Victoria Police, not just those involving legal obligations of confidentiality or privilege, because:

• an oversight model that is broader in scope would help to identify and remedy any circumstances where Victoria Police fails to identify, at the registration phase, that a human source falls into the ‘reportable human source’ category
• previous reviews and inquiries have highlighted risks and concerns surrounding the use of human sources other than those involving legal obligations of confidentiality or privilege (for example, risks related to improper handler–source relationships)
• external oversight would encourage sound, ethical and lawful practice across the entire Victoria Police human source program and, in so doing, make it more likely that appropriate standards will be observed in all cases
• an oversight model would provide assurance to human sources that their police handler is complying with relevant legislative and policy requirements, while also providing assurance to the police handler about the lawfulness of their actions
• the approach is supported by Victorian oversight bodies and other stakeholders
• external oversight of the use of all human sources is critical to restoring community confidence in this program and Victoria Police.

The Commission makes further recommendations related to each tier of the proposed external oversight model below.

The Commission is mindful that IBAC and a small number of other Victorian agencies also use human sources, and that regimes regulating the use of investigative powers and methods in Victoria typically apply to all law enforcement agencies with such powers. While outside the scope of its terms of reference, the Commission suggests, as outlined in Chapter 12, that the recommended new legislation for Victoria Police’s use of human sources should apply to all Victorian agencies that use human sources subject to appropriate consultation. A logical extension of that suggestion, if the Victorian Government accepts it, would be for the recommended external oversight regime to also apply to those agencies.

The Commission urges the Government to take these steps, following consultation with IBAC and other relevant stakeholders. The suggested extension of the external oversight regime to other agencies is discussed further later in this chapter.

Increasing scrutiny of Victoria Police decisions related to ‘reportable human sources’ (Tier 1)

The Commission considers that the PIM should be involved in final decisions to register reportable human sources, noting that:

• stakeholder views support more intensive oversight for certain higher-risk human sources
• robust scrutiny at this early phase provides an opportunity to test the necessity and proportionality of the registration, and to identify and address any risks
• failure to follow a rigorous process and apply critical judgement at the registration phase can have significant consequences for the ongoing management of the human source, as Victoria Police’s experience with Ms Gobbo illustrates.

The Commission considered the possible adoption of the United Kingdom model, where an IPCO Judicial Commissioner approves the registration of human sources where an agency intends to obtain legally privileged information. This approach is similar to that adopted in relation to applications for surveillance device warrants, telecommunications interception warrants and other warrants in Victoria, which are determined by a magistrate or judge.

On balance, the Commission is not attracted to this approach. It considers that an appropriate level of scrutiny and rigour can be achieved without the formality of an independent agency, person or court making the final decision about whether to register a human source. In addition, casting the PIM in a decision-making rather than public interest advocacy role would be a significant departure from its current role in relation to other covert police powers (and from the roles of other Victorian oversight agencies).

Instead, the Commission considers that:

• Victoria Police, via the Chief Commissioner or delegate of or above the rank of Assistant Commissioner, should make registration decisions relating to reportable human sources.¹⁹⁹
• The PIM should have a role in this decision making; namely, to advocate the community’s interest in a process that is necessarily private and shielded from public scrutiny and can result in decisions limiting a person’s human rights.

The Commission proposes that the PIM would fulfil its role by:

• testing whether applications for the registration of reportable human sources are necessary and proportionate to the law enforcement objective sought to be achieved
• testing whether the circumstances are sufficiently exceptional and compelling to warrant the registration of a reportable source where it is intended to obtain or disseminate confidential or privileged information (that is, where there is a serious threat to national security, the community, or the life and welfare of a person; and further, where the information is not able to be obtained through any other reasonable means)
• making recommendations to Victoria Police on the appropriateness of such decisions.

The PIM’s proposed role is set out in Figure 13.4 below.

This model has precedent in Victoria, with the PIM performing a similar role in relation to Victoria Police decisions about witness protection, and a somewhat comparable public interest advocacy role in court applications relating to applications for surveillance devices and telecommunications interception.

Figure 13.4: Overview of proposed role of the Public Interest Monitor in Victoria Police decisions to register reportable human sources

Scope of the Public Interest Monitor’s involvement in the registration of reportable human sources

The PIM’s involvement in the decision-making process is only recommended for the registration of reportable human sources. The Commission considers that it would be disproportionate and unnecessary for all human source registrations to be subject to this external oversight measure, noting the comprehensive compliance-monitoring scheme for ‘Tier 2’ proposed below.

As outlined in Chapter 12, the Commission considers that other complex or higher-risk human sources, such as people under the age of 18 years or with a serious mental or medical health condition, should also be defined as reportable human sources. This would mean any application for the registration of such a person as a human source would be subject to the more rigorous authorisation process, including the PIM’s advice.

The Commission has not formally recommended the PIM’s involvement in decisions relating to these types of human sources, as it falls outside the terms of reference and the Commission has not canvassed the views of key stakeholders from the youth and mental health sectors. Nevertheless, the Commission urges the Victorian Government to consult with relevant stakeholders, with a view to bringing registration and oversight requirements for these human sources into line with those for human sources potentially involving legal obligations of confidentiality and privilege.

Figure 12.4 in Chapter 12 sets out the Commission’s recommended process for registering human sources. In summary, this process would involve the following steps for PIM involvement in final decisions regarding the registration of reportable human sources:

• The Victoria Police handling team submits an application for the registration of a human source to the Human Source Management Unit (HSMU).
• If identified as potentially a prospective reportable human source, the HSMU must obtain formal legal advice from the Victoria Police Legal Services Department or Victorian Government Solicitor’s Office and submit the application and legal advice to the Central Source Registrar (CSR) for review and endorsement.
• If endorsed, the CSR progresses the application and advice to the Chief Commissioner (or delegate) for consideration.
• The Chief Commissioner (or delegate) notifies the PIM of the proposed registration of a reportable source and provides the PIM with all material relevant to the application (including the legal advice and any material adverse to the application).
• The Chief Commissioner (or delegate) decides whether to register the human source, taking into account whether their use is necessary and proportionate, and any recommendations of the PIM (as set out in Figure 13.4 above).

The Commission is aware that the requirement for the HSMU to obtain legal advice and for the PIM’s involvement may seem duplicative; however, it considers that:

• The legal advice should assist the HSMU, CSR and Chief Commissioner to determine the nature of the information the prospective source has access to, or is reasonably expected to have access to (including whether it may be confidential or privileged information), and whether the proposed registration is necessary and proportionate.
• In cases where the CSR or Chief Commissioner is satisfied that registration is not appropriate, there would be no need to engage the PIM.
• In other cases where Victoria Police considers the registration is justified, the PIM would provide a critical external perspective on the merits of that proposed decision. The PIM’s consideration would take into account the legal advice and other material related to the application, which should help expedite the PIM’s assessment and resultant submissions or recommendations.

As noted in Chapter 12, the Commission recognises the importance of Victoria Police being able to act without delay in genuine emergency situations, such as where there is a serious and imminent threat to public safety. The procedures for registering a reportable human source in these circumstances are set out in more detail later in this chapter.

The Public Interest Monitor’s functions relating to the registration of reportable human sources

The Commission considers that the legislative functions of the PIM in relation to Victoria Police decisions to register reportable human sources should be based on its functions under the Public Interest Monitor Act and related legislation. This is for the same reasons set out there; to represent the public interest in what is necessarily a non-public decision-making process about the use of covert, intrusive and human rights-limiting powers and functions.

The PIM’s functions should include:

• testing the content and sufficiency of information relied on in the application to register a reportable human source, including the risk assessment and any other material accompanying the application
• asking questions of any person giving information in relation to the application
• making submissions and recommendations on the appropriateness of, or justification for, registering the proposed human source.

In undertaking these functions, the PIM should consider whether the information supporting the application satisfies the test for registration of a human source set out in Chapter 12; that is, whether the registration is appropriate and justified.

In cases where it is specifically intended to acquire confidential or privileged information, the PIM should also consider whether there are sufficiently exceptional and compelling circumstances to justify the extraordinary step of obtaining or disseminating the information.

The PIM should also have regard to any other legislative, regulatory or policy requirements, and the risk posed by, and mitigation strategies proposed for, the registration of the human source.

The Public Interest Monitor’s functions where there are changes in the scope of the registration

The Commission recognises that any human source could inadvertently or unexpectedly provide confidential or privileged information to Victoria Police.

In the case of a person registered as a non-reportable human source, this would in effect make them a prospective reportable human source. As set out in Chapter 12, the Commission recommends that the information should be quarantined and the human source’s registration suspended. Victoria Police would need to commence a new application so that the person is subject to the more rigorous registration process associated with reportable human sources, including the PIM’s involvement.

Similarly, where a reportable source was registered with no expectation that they would provide confidential or privileged information but ends up doing so, the information should be quarantined.

If, in either of these circumstances, Victoria Police wished to disseminate the confidential or privileged information, it would need to commence a new application seeking the Chief Commissioner or delegate’s authorisation (informed by legal advice and the PIM’s recommendation) that there are exceptional and compelling circumstances.

The Public Interest Monitor’s powers

The Commission considers that the proposed new legislation must clearly set out all the PIM’s powers, to ensure that both the PIM and Victoria Police have a clear understanding of their respective roles and responsibilities.

The PIM requires free and unfettered access to all documents and the power to ask questions of Victoria Police officers and decision makers, in line with its powers under other regimes. The PIM should also have clear powers to make submissions and recommendations to the Chief Commissioner (or delegate).

In Chapter 12, the Commission recommends that, when considering whether to register a reportable source, the Chief Commissioner (or delegate) should be required to have regard to the PIM’s recommendations. As discussed further below, the legislation should also require the Chief Commissioner (or delegate) to, within a reasonable time, take the PIM’s recommended action or advise the PIM as to why they have not taken, or do not intend to take, the recommended action.

Where, as is likely, the Chief Commissioner has delegated his or her power to make relevant decisions to a delegate of or above the rank of Assistant Commissioner, and that delegate has declined to take the recommended action, and the PIM is not satisfied with the delegate’s reasons, the PIM should be able to escalate the matter administratively to the Chief Commissioner for re-consideration.

Emergency authorisations

As noted in Chapter 12, the Commission recognises the importance of Victoria Police being able to act without delay in genuine emergency situations. In line with other police powers, such as those relating to surveillance devices, the Commission considers that Victoria Police should be able to register reportable human sources without PIM involvement in emergency situations.

The Commission considers that this would only be justifiable where there are both exceptional and compelling circumstances and the threat is imminent. As noted above, ‘exceptional and compelling circumstances’ means there is a serious threat to national security, the community or the life and welfare of a person, and the information is not able to be obtained through any other reasonable means.

Where this occurs, application materials should be provided to the PIM as soon as possible after registration and the PIM should be empowered to make submissions or recommendations to the Chief Commissioner or delegate about the adequacy of any decisions made or actions taken.

The Public Interest Monitor’s reporting functions

The Commission recommends that the PIM should report at least annually to the Attorney-General, with a copy provided to the Minister for Police and Chief Commissioner, on the performance of its functions in relation to human sources. The PIM should also be empowered to make ‘special reports’ to the Attorney-General as it deems necessary or on the request of the Attorney-General. These provisions would promote accountability for, and transparency of, Victoria Police’s use and management of human sources and align with the PIM’s functions in relation to the witness protection regime.²⁰⁰

The annual report should include:

• the number of occasions on which Victoria Police notified the PIM of an application to register a reportable human source
• the number of occasions on which Victoria Police notified the PIM of an application to register a reportable human source where it intended to obtain or disseminate confidential or privileged information
• the number of occasions on which the Chief Commissioner notified the PIM of an urgent decision made to register a reportable human source, and whether the PIM was satisfied the circumstances warranted an emergency authorisation
• the number of occasions on which Victoria Police accepted or did not accept a recommendation made by the PIM
• the PIM’s view of the adequacy of reasons given by Victoria Police where the PIM’s recommendation was not accepted
• any other matter relevant to the PIM’s functions.

To ensure transparency and accountability, the Attorney-General should be required to table any report by the PIM in Parliament and cause it to be published on an appropriate Victorian Government website. This is consistent with report tabling requirements under other oversight regimes in Victoria.

The Commission acknowledges that some information contained in reports might be sensitive or risk revealing the identity of the human source. It therefore proposes that the legislation should require the PIM not to include, in any version of a report to be tabled or published, information that may jeopardise the safety of any person, or compromise Victoria Police investigative methods or any current investigations or prosecutions. This obligation is the same as that applying to the PIM’s reporting obligations under the Witness Protection Act.²⁰¹

Victoria Police’s obligations

The Commission has carefully considered the obligations that should be placed on Victoria Police to comply with the proposed new oversight regime. Guidance in this regard can be taken from other regimes where Victoria Police has obligations to the PIM.

In Chapter 12, the Commission recommends that the Chief Commissioner (or delegate) must have regard to the submissions or recommendations of the PIM in making a decision to register a reportable human source.

To support the PIM’s role in this process, the Commission recommends that Victoria Police be subject to additional obligations to notify the PIM of an application and intention to register a reportable human source and to provide the PIM with copies of all information supporting the application, including any content that is adverse to the registration or proposed use of the reportable human source. This would allow the PIM to make a proper assessment and test all relevant information.

Where the Chief Commissioner makes an emergency authorisation without engaging the PIM, Victoria Police should provide the PIM with details of the registration as soon as practical after it occurs. This would include the application, supporting material, any content adverse to the registration, and the reasons why an emergency authorisation was necessary. In these circumstances, the Chief Commissioner should also be required to explain to the PIM how the circumstances of the registration met the threshold for an emergency authorisation.

Consistent with requirements under other external oversight regimes, the Commission also considers that Victoria Police should be subject to a general obligation to provide reasonable assistance to the PIM to support it in exercising its functions.

Monitoring compliance of Victoria Police’s use of all human sources (Tier 2)

Tier 2 of the Commission’s recommended oversight model involves retrospective monitoring of compliance with the human source management framework. As displayed in Figure 13.5 and discussed in further detail below, this aspect of the external oversight regime would:

• involve an external oversight agency conducting periodic inspections of Victoria Police records to monitor compliance with the framework governing the registration, use and management of all human sources
• allow the external oversight agency to look behind documentation to assess the appropriateness of Victoria Police decisions, ensure practice reflects formal records, and assess the adequacy of administrative policies and procedures
• require Victoria Police to report at regular intervals (for example, every three or six months) to the oversight agency when it has obtained confidential or privileged information from a human source, outlining how it has been or will be dealt with
• require Victoria Police to report to the oversight agency at regular intervals any material non-compliance with the human source management framework, along with steps taken to remedy any impact in the individual case and to avoid future recurrence
• allow the external oversight agency to make recommendations to the Chief Commissioner regarding any matter relating to its oversight functions
• require the external oversight agency to report to the Attorney-General annually (and at other times as it deems necessary or when requested by the Attorney-General) on Victoria Police compliance and related matters
• be tailored to ensure oversight mechanisms are proportionate to risk and benefits of the use and management of various types of human sources, and to avoid an unnecessary administrative burden on Victoria Police.

As noted above, the Commission recognises that Victoria already has a number of oversight agencies and it does not wish to add to this already crowded arena. As such, the Commission has considered which of the existing oversight agencies would be most appropriate to undertake this Tier 2 oversight function. It identified IBAC and the VI as the two most likely candidates.

The benefits of IBAC performing this role include that:

• It already monitors Victoria Police’s compliance with various legislative regimes enabling the use of covert and other investigative powers and functions, and some of its compliance-monitoring functions are more intensive than those exercised by the VI.
• The human source oversight function would sit comfortably with IBAC’s broader police integrity functions, noting that it can already conduct own motion investigations and may receive complaints about Victoria Police’s use of human sources.

By contrast, the advantages of the VI undertaking this role are:

• It already has compliance-monitoring functions in respect of certain other Victoria Police covert powers and functions, such as controlled operations, which sometimes involve the use of human sources.
• Unlike IBAC, it does not use human sources itself; consequently, there is no potential for a perceived or actual conflict arising from an agency overseeing the use of powers by Victoria Police that it also uses itself.

On balance, the Commission considers that the benefits of IBAC monitoring Victoria Police’s compliance with the human source management framework outweigh the benefits of the VI undertaking the role. It considers that any risk of conflict between IBAC’s own use of human sources and its monitoring of Victoria Police’s compliance should be manageable, particularly given the already existing ability for Victoria Police or members of the public to make complaints to the VI should there be any concerns about IBAC’s use of human sources.

An overview of IBAC’s proposed compliance monitoring role is displayed in Figure 13.5 below.

Figure 13.5: Overview of proposed retrospective compliance-monitoring regime

While outside the Commission’s terms of reference, in Chapter 12 the Commission urges the Victorian Government to extend the proposed new legislation to all Victorian agencies using human sources, including IBAC. As a logical extension, the Commission has also proposed that the recommended external oversight regime should also apply to those agencies. The significant risks, together with the benefits associated with Victoria Police’s use of human sources also exist for other agencies that use sources, even though their programs are of a lesser scale.

Should the Government accept this suggestion, the choice of agency to perform the function is a challenging one. In part, that is a measure of the complexity of the integrity framework that has evolved in Victoria. While not having consulted on this specific issue given the constraints of the terms of reference, the Commission suggests that, based on the current configuration of Victoria’s integrity and oversight system, the VI is arguably the most appropriate compliance monitor of IBAC and the other agencies’ use of human sources. The Commission acknowledges that this would result in both IBAC and the VI overseeing human source use in Victoria, and also that complexities could arise where, for example, Victoria Police uses a human source in a controlled operation, with IBAC responsible for overseeing the use of the human source and the VI the controlled operation.

The Commission does not want to see these complexities impede the swift implementation of the necessary reforms it has recommended in respect of Victoria Police. Whether the recommended legislative and oversight regime should apply to agencies other than Victoria Police, and which agency or agencies would be best suited to perform this oversight function, could be considered further alongside the broader review of the institutional and legislative framework for external police oversight that the Commission recommends later in this chapter.

The Commission is mindful that some stakeholders were critical of a retrospective compliance-monitoring approach, as it may not allow issues to be identified or external scrutiny applied in real time (that is, it may be too late to identify and rectify any issues of concern). The proposed ‘Tier 1’ oversight role of the PIM as an advocate in the decision-making process for the most sensitive and high-risk human source management decisions is intended in part to address this concern at the ‘front end’; that is, before any use is made of a reportable human source. More extensive use of real-time monitoring, would, in the Commission’s view, be:

• unworkable, given the sometimes extensive level of interaction between police and human sources and the need for police to respond quickly when taking actions or making decisions about a source’s day-to-day management
• undesirable, as it would ‘second-guess’ police operational decision making, create a significant administrative burden, and dilute Victoria Police’s primary responsibility for ensuring effective, efficient and ethical practice in the use of human sources
• unnecessary, as the proposed oversight model ensures transparency and encourages compliance and high professional and ethical standards.

Scope of IBAC’s compliance-monitoring function

For the reasons outlined above, the Commission considers that IBAC’s compliance-monitoring functions should apply to Victoria Police’s use and management of all human sources. To ensure proportionality, the intensity of compliance monitoring should be commensurate with the risk posed by categories of human sources and/or the information they provide, so that the purpose of external oversight can be achieved with the minimum possible administrative burden on Victoria Police.

IBAC’s compliance-monitoring functions

The Commission considers that IBAC should have legislative functions to monitor, make recommendations about and report on Victoria Police’s compliance with the framework for the registration, use and management of all human sources. Consistent with other compliance-based oversight regimes in Victoria, these legislative functions should include conducting periodic inspections of Victoria Police records (for example, every six months).

The compliance-monitoring function should apply to the entire period of a human source’s registration, not just the initial registration decision. The circumstances and risks associated with a human source can change over the period of their registration. The approach recommended by the Commission reflects that the use and management of a source—particularly where they are to be tasked and rewarded—involves significant risks throughout the entire period of registration, and sometimes, even after the source has been deactivated.

The Commission is mindful of evidence that traditional compliance-monitoring regimes focusing on matters such as record-keeping requirements, while beneficial, have their limitations. For example, if IBAC’s role were limited to monitoring whether a risk assessment had been undertaken and documented, without considering the quality and adequacy of the risk assessment, its external oversight function may be of limited utility. The Commission therefore considers that IBAC should be able to look behind formal documentation to assess whether decisions made by Victoria Police are sound.

The Commission understands that this approach aligns with IPCO’s oversight of human source management in the United Kingdom and IGIS’ focus on the lawfulness and propriety of Australian intelligence agencies’ use of human sources; and, in the Victorian context, bears some similarity to IBAC’s existing compliance-monitoring functions in relation to firearm prohibition orders.

As the Commission proposes that compliance-monitoring should apply to all human sources (not just reportable human sources), and include an element of qualitative assessment in addition to technical compliance, it considers that the legislative framework should permit IBAC to discharge its functions by examining a representative sample of human source files for each reporting period. This approach is similar to IBAC’s existing oversight of firearm prohibition orders, and with IPCO’s compliance-monitoring approach in the United Kingdom,²⁰² and would provide IBAC with the ability to target its inspection activities; for example, based on common risks and themes identified in previous inspections.

The Commission notes that in the United Kingdom, public authorities are required to report compliance errors to IPCO, and to explain what is being done to prevent recurrence. This serves a specific purpose, as the Investigatory Powers Commissioner is required by law to disclose certain serious errors to affected persons. The Commission considers that reporting compliance errors or breaches to IBAC could have several benefits; namely, it could:

• provide additional rigour by requiring IBAC to assess whether any breaches or deviations warrant investigation or remedial action
• enable IBAC to assess whether appropriate remedial steps have been taken
• assist IBAC in discharging its compliance-monitoring functions
• help ensure early identification and rectification of emerging issues or concerns
• encourage Victoria Police to adopt cultural change and invest in and proactively manage internal compliance.

The Commission is mindful, however, that reporting all breaches or deviations could impose a significant administrative burden on Victoria Police and may be a disproportionate requirement for minor breaches. This reporting obligation should therefore be confined to material breaches of, or material deviations from, the human source management framework. The terms ‘material breach’ and ‘material deviation’ should be defined in consultation with IBAC and Victoria Police in developing the proposed new legislation, focusing on matters that could have a significant adverse impact on the integrity of human source management, community confidence and/or the administration of justice. The Commission considers that Victoria Police should report regularly to IBAC on the occurrence of any such material breaches or material deviations (for example, every three or six months).

The Commission has also considered whether additional safeguards should apply to confidential or privileged information. This type of information, and its unintentional receipt, use, dissemination or retention by Victoria Police, has been a key focus of the Commission’s work. Its improper use and management raise legal and ethical issues for Victoria Police and other agencies (such as the Office of Public Prosecutions). It can also have significant impacts on individuals and the broader criminal justice system. As discussed in Chapter 12, it is not always easy or possible for a police officer or the human source to determine whether information is confidential or privileged, and whether it is appropriate to provide, obtain or disseminate such information.

Consequently, as an added safeguard, the Commission considers that Victoria Police should report to IBAC at regular intervals (for example, every three or six months) on any confidential or privileged information it has obtained from a human source. This report should include how police have dealt with, or propose to deal with, that information (including the PIM’s advice on the source’s registration, how Victoria Police responded to it and any other measures it may have put in place). IBAC’s role would include assessing such reports, confirming that mandated controls are in place and, if these measures are considered inadequate, making recommendations to improve internal procedure.

The Commission notes that law enforcement agencies in the United Kingdom must report the receipt from a human source of confidential and privileged information to IPCO, whose functions include ruling on whether privileged information should be destroyed or may be retained.²⁰³ The Commission does not recommend IBAC be involved in these decisions, noting that it would not be consistent with IBAC’s existing functions, and further that under the recommended model, the PIM would be engaged in final decisions about the registration of reportable sources and provide advice on the proposed use of that source and any confidential or privileged information they may provide. In addition, IBAC’s regular review, as proposed above, would further assist Victoria Police to ensure this sensitive information is managed appropriately.

IBAC’s powers and Victoria Police obligations

The Commission considers that IBAC should have the full suite of powers normally associated with compliance-monitoring and inspection regimes, including powers to enter premises; inspect, copy and take extracts from documents; ask questions; and request additional information. Further, the Chief Commissioner should have a legislative obligation to ensure that all officers and employees of Victoria Police give IBAC all reasonable assistance to discharge its functions.

In addition to the power to make recommendations to Victoria Police outlined above, IBAC should also have the power to examine whether and how they are implemented.

As noted above, the Chief Commissioner should also have specific legislative obligations, including to report at regular intervals on certain compliance breaches and on the management of confidential or privileged information obtained from human sources.

IBAC’s reporting functions

The Commission considers that IBAC should have reporting and recommendation-making functions to foster transparency, accountability and a culture of continuous improvement in the use and management of human sources by Victoria Police.

The Commission considers that IBAC should be required to report annually to the Attorney-General on the performance of its legislative functions in relation to the use of human sources. The report should include:

• Victoria Police’s compliance with the human source management framework, including the appropriateness of its decisions, based on a representative sample of cases
• the number and nature of material breaches or deviations reported by Victoria Police, and the nature and adequacy of remedial actions
• the dissemination of confidential or privileged information by Victoria Police
• any recommendations made by IBAC to Victoria Police and Victoria Police’s response and progress in implementing them
• any other matters relevant to IBAC’s compliance-monitoring functions under the proposed legislation.

To ensure that emerging issues can be raised in a timely manner, IBAC should also have the power to report to the Attorney-General at any other time it considers necessary. In addition, the Attorney-General should

be able to request a report when the Attorney-General considers it warranted. A copy of these reports should also be provided to the Chief Commissioner and the Minister for Police.

To ensure transparency and accountability and consistent with tabling requirements under other oversight regimes in Victoria, the Attorney-General should be required to table the IBAC’s report in Parliament, and cause it to be published on an appropriate Victorian Government website.

Victoria’s compliance-monitoring regimes already require oversight agencies, such as the VI and IBAC, to make public reports on sensitive police operational areas, such as controlled operations and surveillance devices. To minimise any risk to personal security, investigative methods or current investigations and prosecutions, the proposed legislation should require the IBAC to remove or redact any such content from the version of the report to be tabled or published.

In addition to reporting, IBAC’s ability to recommend improvements to the administration of Victoria Police’s human source management framework will be critical to the effectiveness of the oversight regime. IBAC’s power to make recommendations should be comprehensive, including, for example, improvements to police policies and procedures. The Commission envisages that IBAC and Victoria Police would work closely and cooperatively on formulating and implementing recommendations, underpinned by the legislative requirements for the Chief Commissioner to either accept IBAC’s recommendations or respond in writing explaining why they have not been accepted.

The Commission notes IBAC’s compliance-monitoring role in respect of Victoria Police’s use of firearm prohibition orders provides a good basis for such a model. In this scheme, the making of recommendations in individual cases occurs in private and is shielded from public scrutiny on account of the sensitive information involved, which, if released, could endanger a person, disclose police methods or compromise a current investigation or prosecution. Nevertheless, the scheme provides the community with a general insight into whether the exercise of police powers was appropriate and justified through the mandatory public reporting of the number of recommended actions and how often Victoria Police took these actions.

Reviewing and investigating complaints (Tier 3)

The Commission acknowledges that the investigation of complaints made about Victoria Police’s use and management of human sources will remain a necessary part of the external oversight framework. IBAC’s existing complaints-based jurisdiction would be complemented by the additional oversight arrangements proposed by the Commission in this chapter. Additionally, the Commission recommends that Victoria Police be required to inform human sources upon registration that they are able, at any time during or following their period of registration, to make a complaint to IBAC about the conduct of police officers, and that they may be afforded the protections available under the Public Interest Disclosure Act 2012 (Vic).

Due to the different areas of focus between this Commission and the IBAC Parliamentary Committee, there is no significant overlap or intersection between this Commission’s recommendations and those of the 2018 IBAC Committee Inquiry; nor are any recommendations from this Commission and the Committee’s reports inconsistent.

The Commission does note that any efforts to strengthen IBAC’s oversight functions and powers in relation to Victoria Police—to the extent that this will raise standards, ethical decision making and public confidence—will have collateral benefits for Victoria Police’s human source management. The Commission therefore urges the Government to respond to the IBAC Parliamentary Committee’s report, and implement any relevant recommendations, as a matter of priority.

Information sharing

Victorian oversight agencies told the Commission that constraints on the sharing of information between agencies can pose challenges.

To ensure that external agencies responsible for overseeing human source management have all relevant information to perform their functions, legislation should allow the PIM and external oversight agencies to share information where they reasonably believe such information is relevant to another agency’s functions.

In the context of the Commission’s recommended external oversight model, IBAC would undertake reviews after a reportable human source has been registered or after confidential or privileged information has been used or disseminated. The PIM would have been involved in making recommendations or submissions on these matters before the decisions are made (or soon after in emergency circumstances) and, therefore, would have an interest in the external oversight agency’s review. This is both in terms of the specific case and the lessons it may contain for the PIM’s consideration of, and recommendations in, future cases. This arrangement already exists for both these agencies in their respective oversight roles in Victoria’s Witness Protection Program.²⁰⁴

The Commission is aware that information shared could be highly sensitive. It is therefore important that the external agencies are provided with sufficient capacity and infrastructure, and have appropriate protocols, to securely share, store and dispose of sensitive information. Additionally, external oversight agencies must have staff with the appropriate security clearances to receive and review the information provided by Victoria Police.

Implementation of the new oversight model

The Commission agrees with stakeholder views about the importance of careful, comprehensive and coordinated implementation planning and delivery to establish a successful new oversight model. Implementation planning would need to consider lead times and resources required to build organisational capacity and capability, develop secure systems and establish operating procedures.

Capability, expertise and capacity

The Commission heard that external oversight regimes are most effective where the oversight agency understands the environment in which law enforcement agencies operate. This understanding is in addition to the technical capability required to discharge the oversight agency’s functions.

The Commission notes that the PIM has the technical legal capability required to discharge its proposed functions of testing the content and sufficiency of applications to register a reportable human source.

A PIM (whether the Principal PIM or a Deputy PIM) must be an Australian lawyer²⁰⁵ and the Commission observes that the Governor in Council has always appointed senior legal figures to these roles. This legal expertise may be supplemented by building the PIM’s specific knowledge in relation to human source management; for example, through training and/or engagement with Victoria Police and IBAC. Modelling would also need to be undertaken to determine whether the PIM has capacity, under its current resourcing model, to deal with the increased demand from this new jurisdiction; however, the Commission does not expect the increase to be substantial, noting that, as discussed in Chapter 12, of the approximately 1,200 human source registration applications submitted between July 2017 and June 2020, only about 4.4 per cent were potentially subject to legal obligations of confidentiality or privilege.²⁰⁶

The Commission notes that IBAC has the audit and compliance-monitoring capability required to discharge the functions recommended under the proposed model. Given that IBAC’s jurisdiction is proposed to have more qualitative aspects than other covert powers monitoring regimes—in that it should inquire into the rigour and judgement applied in the making of decisions—it would be important for it to build organisational expertise around human source management in an operational policing context. This may occur through recruitment, training and/or engagement with Victoria Police and interstate or federal oversight agencies. As this would be a substantial new jurisdiction for IBAC, both in breadth and depth, modelling would need to be undertaken to ensure IBAC has the necessary staffing capacity, capability and resources to discharge its functions. Similarly, the Commission appreciates the VI may require similar planning and resourcing should it be given new oversight functions over IBAC and other agencies’ use of human sources.

Stakeholders have mentioned the benefits of a cooperative model, whereby the external oversight agency could embed staff with Victoria Police to obtain a more in-depth understanding of its systems and procedures. The Commission believes that this could be a valuable approach to explore, but also emphasises the need to avoid developing an overly familiar relationship that could compromise the independence of the oversight agency.

Security, funding and implementation governance

The Commission agrees with stakeholder views that security needs to be a primary focus in implementing external oversight of Victoria Police’s use of human sources. The PIM and IBAC are accustomed to handling highly sensitive material under their existing legislative functions. Leveraging off these foundations, planning would be required to ensure that ICT systems and applications, operating procedures and clearance levels of personnel are robust and meet the risk profile required of human source management. These matters would need to be worked through by oversight agencies and Victoria Police.

IBAC told the Commission that any external oversight regime for human sources ‘would need to be supported by legislation and … sufficient investment by Government to both implement and maintain independent oversight’.²⁰⁷ The Commission considers that the PIM and IBAC would require additional funding to fulfil their new oversight functions. Cost drivers may include additional staffing, training, infrastructure, information technology and personnel security, business applications and the development of new operating procedures. Victoria Police would also likely incur costs in adapting and responding to the new oversight model, which may not be able to be met through existing funding or internal reprioritisation.

Similar considerations of resourcing needs would apply to the VI, should it be given new oversight functions of IBAC and other agencies’ use of human sources.

Chapter 17 deals with governance structures to monitor implementation of the Commission’s recommendations. It will be important that, as part of this process, there is strong, central coordination of the implementation of the human source oversight arrangements proposed in this chapter.

A principle-based review of external oversight of police powers in Victoria

As outlined above, Victoria Police exercises investigatory and associated powers under a range of statutes that also establish specific external oversight regimes. The Commission heard that despite common themes (such as compliance monitoring and reporting), variation across these oversight regimes creates a system that is:

• fragmented—with different agencies performing like functions under the different regimes applicable to Victoria Police
• inconsistent—with variation in the form and substance of oversight agencies’ functions, powers and reporting arrangements, and thus the type and level of oversight exercised
• limited—with a somewhat technical and procedural focus on compliance, rather than a more substantive assessment of whether decisions and actions are necessary, proportionate, ethical and justified.

The Commission heard that to some extent, the current configuration of the oversight system is not underpinned by principle or a sound policy rationale. Rather, to reiterate IBAC’s view quoted above, the current oversight system:

… contains elements of fragmentation caused by a lack of role clarity around some areas of oversight, as well as inconsistencies in the type and level of oversight exercised by each agency. Broadly, this reflects a lack of [a] cohesive framework based on established oversight principles, the expansion of law enforcement powers and the ad hoc development of the integrity system as a check and balance on those increased powers.²⁰⁸

The Commission is mindful that the recommended oversight regime for the use of human sources unavoidably adds to the ad hoc development of Victoria’s oversight system. The Commission also notes that the external oversight regime recommended in relation to human sources is in many ways more robust than regimes that apply to other police powers and methods.

Consequently, the Commission considers that there would be merit in the Victorian Government undertaking a principle-based review of the institutional and legal structure for the oversight of police powers in Victoria. It may be timely to undertake this review in tandem with the policy response to the 2018 IBAC Committee Inquiry. The potential benefits of such a review include:

• streamlining, consolidating or rebalancing oversight jurisdiction between existing integrity bodies to ensure clarity and coherence around roles, responsibilities and areas of specialisation, so that system design can best achieve the desired outcomes (such as good, ethical and accountable police practice, transparency and public confidence)
• shifting to a more meaningful, outcome-focused form of monitoring where the necessity, proportionality and justification of decisions made and actions taken is the focus of the assessment and reporting
• where possible and justified, ensuring that functions, powers and obligations are consistent across different oversight regimes, and proportionate to the level of intrusiveness and/or risk associated with the use of the police power
• easing the compliance burden for Victoria Police, while improving accountability.

The Commission recognises that such a review would not be a trivial undertaking. It would require extensive consultation with integrity bodies, law enforcement agencies, experts and stakeholders. Further, implementing any reforms arising from such a review would likely require legislative amendment and have a range of organisational and funding implications. These reforms would take time to complete.

Consequently, the Commission considers that its recommendations for external oversight of Victoria Police’s use of human sources should be developed and implemented simultaneously with the proposed principle-based review, and not deferred pending the outcome of this review and any resultant reforms to the broader police oversight system.