Crimes Act 1914

An account takeover warrant must authorise the doing of specified things (subject to any restrictions or conditions specified in the warrant) in relation to each target account.

The things that may be specified are any of the following that the magistrate considers appropriate in the circumstances:

taking control of the target account at any time while the warrant is in force, if doing so is necessary, in the course of the investigation to which the warrant relates, for the purpose of enabling evidence to be obtained of the commission of the alleged relevant offence, or alleged relevant offences, in respect of which the warrant is issued;

using:

a computer; or

a telecommunications facility operated or provided by the Commonwealth or a carrier; or

any other electronic equipment; or

a data storage device;

if necessary for the purpose of taking control of the target account as mentioned in paragraph (a):

accessing account‑based data to which the target account relates; or

adding, copying, deleting or altering account credentials to which the target account relates; or

adding, copying, deleting or altering data in a computer;

if, having regard to other methods (if any) of taking control of the target account which are likely to be as effective, it is reasonable in all the circumstances to do so:

using a communication in transit for the purpose of taking control of the target account as mentioned in paragraph (a); and

if necessary to achieve that purpose—adding, copying, deleting or altering data in the communication in transit;

copying any account‑based data to which the target account relates, and that:

appears to be relevant for the purposes of determining whether the account‑based data is covered by the warrant; or

is covered by the warrant;

copying any account credentials to which the target account relates;

any other thing reasonably incidental to any of the above.

For the purposes of paragraph (2)(e), if:

access has been obtained to account‑based data; and

the account‑based data is subject to a form of electronic protection;

For the purposes of this section, account‑based data is covered by a warrant if access to the data is necessary, in the course of the investigation to which the warrant relates, for the purpose of enabling evidence to be obtained of the commission of the alleged relevant offence, or alleged relevant offences, in respect of which the warrant is issued.

Subsection (2) does not authorise the addition, deletion or alteration of data, or the doing of any thing, that is likely to:

materially interfere with, interrupt or obstruct:

a communication in transit; or

the lawful use by other persons of a computer;

cause any other material loss or damage to other persons lawfully using a computer.

If any thing has been done under:

an account takeover warrant; or

this subsection;

any thing reasonably necessary to conceal the fact that any thing has been done under the warrant or under this subsection;

if, having regard to other methods (if any) of doing the things mentioned in paragraph (c) which are likely to be as effective, it is reasonable in all the circumstances to do so:

using a computer or a communication in transit to do those things; and

if necessary to achieve that purpose—adding, copying, deleting or altering other data in the computer or the communication in transit;

any other thing reasonably incidental to any of the above;

at any time while the warrant is in force or within 28 days after it ceases to be in force;

if none of the things mentioned in paragraph (c) are done within the 28‑day period mentioned in paragraph (f)—at the earliest time after that 28‑day period at which it is reasonably practicable to do the things mentioned in paragraph (c).

Subsection (6) does not authorise the doing of a thing that is likely to:

materially interfere with, interrupt or obstruct:

a communication in transit; or

the lawful use by other persons of a computer;

cause any other material loss or damage to other persons lawfully using a computer.

An account takeover warrant is subject to the following conditions:

the warrant must not be executed in a manner that results in loss or damage to data unless the damage is justified and proportionate, having regard to the alleged relevant offence, or alleged relevant offences, in respect of which the warrant is issued;

the warrant must not be executed in a manner that causes a person to suffer a permanent loss of:

money; or

digital currency; or

property (other than data).

Subsection (8) does not, by implication, limit the conditions to which an account takeover warrant may be subject.

The conditions set out in subsection (8) must be specified in an account takeover warrant.