Cellebrite in Australia: NSW and Victoria Phone-Access Powers Explained

Cellebrite Australia sits at the centre of claims about NSW Police phone extraction, but the legal power and the forensic vendor are separate questions. New South Wales has proposed a second route for compelling access to seized phones and computers. Victoria already has warrant-linked powers that can require access assistance. The Crimes and Other Legislation Amendment (Further Organised Crimes Reforms) Bill 2026 would let NSW Police apply for a digital evidence access order after a device is lawfully seized without a search or crime scene warrant. The proposal is narrower than claims that police could clone any phone at any traffic stop, but it would still expand coercive access and expressly remove self-incrimination as an excuse for refusing.

Stronger versions are circulating too: that the bill creates “effectively unfettered” roadside extraction, makes Cellebrite spyware an everyday policing tool, exposes every message, photo, location, search and biometric record, stores all extracted data indefinitely, and brings an automatic ten-year refusal penalty. Those claims are documented below rather than erased. Some describe real privacy risks or reported police practice; some collapse separate legal steps; some depend on records that were reported but were not available in the bill or procurement profile; and the ten-year phone-refusal claim is contradicted by the bill.

Bill status and commencement

Police Minister Yasmin Catley introduced the government bill in the Legislative Assembly on 6 August 2026. Parliament records it at second reading, with debate adjourned for five clear days. It has not passed either House and has not received assent.

If Parliament passes it, the Crime Commission penalty changes and most other schedules would start on assent. The new organised-crime digital evidence access orders, together with their Criminal Procedure Act consequence, would start later on a day or days appointed by proclamation. The second-reading speech says that delay is intended to allow new forms, records rules, and police system changes.

What the law says: NSW and Victoria compared

The comparison does not mean NSW is copying Victoria provision for provision. Victoria’s powers remain anchored to a search warrant issued under section 465. The NSW bill is designed to add an order route after a device has already been seized under another lawful power. Victoria applies to evidence of an indictable offence; the proposed NSW route requires the narrower statutory category of a listed serious offence linked to organised crime.

Victoria: what is already in force

Sections 465AAA and 465AA of the Crimes Act 1958 (Vic) operate after a magistrate issues a section 465 search warrant. The warrant itself may authorise an executing officer to direct a specified person to provide reasonable and necessary information or assistance. Separately, a senior-sergeant-or-higher police officer may ask the Magistrates’ Court for an assistance order when the warrant is sought or later.

Both routes require reasonable grounds to suspect that data will afford evidence of an indictable offence. The person must fall within a defined relationship to the device or network and have relevant knowledge of it or its data protections. The Act permits access, copying and conversion of data into an intelligible form, including data accessible from a device seized under the warrant and held elsewhere.

Failure without reasonable excuse carries a maximum of two years for a direction already authorised by the warrant and five years for breach of a later court order. In both provisions, possible self-incrimination is expressly not an excuse. These are maximums, not automatic sentences. Victorian Sentencing Advisory Council data show that section 465AAA is used in practice, rather than being a dormant power.

What governments and police say

The NSW government says organised-crime networks use “encrypted technology, middlemen and vulnerable young people” to distance organisers from violence. Police Minister Yasmin Catley described the response as “stronger laws, stronger powers and stronger tools to access and compel information”. NSW Police Commissioner Mal Lanyon told the ABC that police had previously prevented crimes after lawfully seizing phones or laptops but lacked lawful access, and that the bill would let investigators seek a Local Court order and “solve crime quickly”. AAP independently reported the government case as faster access for drug supply, illicit tobacco, fire-bombing and public-place shooting investigations.

The Victorian government’s position is that encryption can make a digital container harder to execute a warrant against than a locked room or safe. Its 2022 major-crime reforms expanded warrant execution so police could access, copy and convert data themselves, deal with a device already seized and held away from the warrant premises, and secure equipment while an expert attended. The government described those changes as adapting warrant execution to current technology and preserving evidence that could otherwise be altered or destroyed.

The same reforms added operational safeguards around expert access: police must minimise disruption, ordinarily secure equipment for no more than 24 hours before an expert attends, and stop within 24 hours of arrival unless the Magistrates’ Court grants an extension. An extension may not exceed seven days at a time. Police must report warrant execution to the Magistrates’ Court, including details of electronic equipment secured and assistants used.

What Greens and civil-liberties critics say

NSW Greens justice spokesperson Sue Higginson calls the package a “vast expansion of anti-privacy laws” and a “serious attack on civil liberties”. Her strongest warning is that police can obtain a person’s messages, photos, location, searches and biometric data, with no public reporting on Cellebrite use or known rules for retention, sharing and destruction. She also says powers framed around organised crime will in practice apply to everyone. That concern is broader than the legal eligibility test: the bill still requires the listed-offence, organised-crime, seizure and judicial thresholds, but any person who fits the named-person and knowledge tests can be the subject, not only a convicted organised-crime figure.

Victorian Greens positions are not uniformly opposed to access assistance. In the 2015 debate that inserted section 465AAA, the party acknowledged concerns but accepted the minister’s case that encryption should not block a child-abuse-material investigation. In adjacent surveillance debates, Victorian Greens have pressed for court supervision, non-interference limits, reporting and protection for innocent people caught in broad powers. That mixed record is more informative than treating “the Greens” as a single position across jurisdictions and bills.

The wider civil-liberties counterpoint is that a phone is not merely a physical container. It can expose years of communications, location history, contacts, cloud sessions and third-party information. The Victorian provisions override self-incrimination as an excuse and do not create a direct-use immunity for the accessed material. Legal and privacy criticism therefore focuses on the breadth of the data reached, whether a warrant and assistance direction are sufficiently particular, access to legal advice, retention and secondary use, and the limited public visibility of forensic extraction practices. Victoria’s information commissioner separately found deficiencies in Victoria Police privacy training and internal visibility of complaints. That does not prove misuse of phone extractions, but it is relevant evidence when assessing trust in downstream data handling.

Those positions are not mutually exclusive facts. Encrypted evidence can impede serious-crime investigations, and compelled access can create unusually deep privacy and procedural consequences. The relevant policy question is whether necessity, offence thresholds, judicial supervision, particularity, reporting, retention controls and remedies stay proportionate to that intrusion.

NSW: what changes from the existing law

NSW already has digital evidence access orders. Division 4A of the Law Enforcement (Powers and Responsibilities) Act 2002 lets investigators seek an order for a computer found, or expected to be found, while executing a search warrant or crime scene warrant. The new bill would rename those as digital evidence access orders (warrant) and add Division 4B for digital evidence access orders (organised crime).

The new route begins only after a police officer has lawfully seized a device by some power other than the relevant search or crime scene warrant. A police officer may apply within 14 days of seizure. A later application is possible only if applying within 14 days was not reasonably practicable.

The application must describe how and when police obtained the device, the alleged organised-crime offence, why its data is suspected to be connected or relevant, and why the proposed subject is suspected of committing or knowing about that offence. If the subject is under 18, an inspector or higher-ranked officer must authorise the application.

The warrant question, stated accurately

The judge may grant the order only after finding reasonable grounds to believe the device was lawfully seized, suspect its data is connected or relevant to an organised-crime offence, suspect the named person committed or knows about the offence, and believe that person has relevant knowledge of the device, network, or protections on the data. The judge must consider the reliability and source of the information supporting the application.

Applications can be made in person or electronically. Telephone applications are reserved for urgent cases where the other routes are not practicable. Refused applications cannot simply be shopped to another decision-maker unless a later application supplies additional information justifying it.

Which investigations qualify

The proposed order is not available for every offence. The bill defines an organised-crime offence as a listed serious offence linked to organised crime. The list reaches aggravated property destruction, homicide and other specified Crimes Act offences, sexual offences, drug offences, criminal-group offences, robbery, fraud, specified firearms offences, illicit-tobacco offences, and offences later prescribed by regulation.

The organised-crime link may include offending by two or more people, substantial planning and organisation, systemic and continuing activity, conduct aimed at profit, power, or influence, or retribution against another person or group. The list of indicators is not exhaustive. That gives police and the issuing judge room to rely on other indicators, but it does not erase the listed-serious-offence threshold.

What an order can compel

Once issued, the executing officer could direct the named person to give information or assistance that is reasonable and necessary to access data held in or accessible from the specified device. The same direction may require assistance to copy data to another computer or convert it into an intelligible form. The bill expressly includes assistance with biometric protections such as fingerprints or retina scans.

The access-information itself may be used only to gain access, but that purpose limit is not a deletion rule for data copied from the device. The order runs for seven business days and may be extended by an issuing officer for up to three additional seven-business-day periods. A further order may also be sought for the same computer.

Police must show the order if the subject asks to inspect it. For a person under 18, police must take reasonable steps to have a suitable parent, guardian, or other representative present when giving the direction.

Penalties and compelled self-incrimination

Proposed section 76AZG makes it an offence, without reasonable excuse, to disobey a direction or give materially false or misleading information in purported compliance. The maximum is 100 penalty units, seven years imprisonment, or both. The same bill raises the current maximum for non-compliance with a warrant-linked DEAO from five to seven years.

The bill says it is not a reasonable excuse that compliance would tend to incriminate the person or expose them to a penalty. It does not add an express legal-professional-privilege clause. That absence should not be converted into a claim that every privilege is abolished; the text is explicit only about self-incrimination as an excuse for non-compliance.

The separate Crime Commission schedule contains several different offences and maximums. Ten years applies to giving false or misleading evidence at a Commission hearing. Failure to attend and answer questions would carry a four-year maximum. Production-notice and disclosure offences have their own penalties. Saying that phone refusal attracts ten years combines separate regimes and is wrong.

What can and cannot be verified

The proposed safeguards include judicial issuance, sworn or affirmed application material, defined statutory thresholds, a record of the grounds for granting or refusing an order, an obligation to produce the order on request, time limits, restrictions on repeat applications, and extra steps for children. Police who knowingly give materially false or misleading information in an application face a maximum of two years.

The bill contains no express sunset for the new power and no dedicated statutory review or public reporting clause for the proposed Division 4B. Section 237A required a review of the provisions inserted by the 2022 Act; the August 2026 bill does not amend that definition to include the new division. Its second-reading speech says regulations will update record-keeping and inspection rules, but the bill does not create public statistics on applications, grants, extracted devices, retention, sharing, or deletion.

That gap is central to civil-liberties criticism. The absence of public reporting does not prove every allegation about volume, retention or misuse, but it also prevents the public from testing broad official reassurance against complete data. Michael West Media, Green Left and Sydney Criminal Lawyers document the same concern from different perspectives. Their strongest claims remain attributed where the underlying police records were not independently available.

Cellebrite Australia: allegation, capability and evidence

The bill never mentions Cellebrite, UFED, phone cloning, spyware, or any other forensic product. Michael West Media reports that NSW Police FOI material showed 160 Cellebrite kits at 30 June 2025 and annual phone-scan counts of 13,897, 7,765 and 9,132 over the preceding three financial years. It also reports Catley saying NSW Police “does not, nor has it ever, engaged Cellebrite to facilitate digital surveillance”, while acknowledging Cellebrite use and commercial-in-confidence expenditure. Those claims and that apparent terminology conflict are material. The underlying FOI files were not located in the reviewed public sources, so the figures are attributed rather than certified here.

A Buy NSW supplier profile verifies that Cellebrite Australia is registered as a government supplier. It does not identify a NSW Police contract, quantity, product, extraction count, retention rule or operational use. Cellebrite’s own product material supports capabilities such as device unlocking and extraction, but capability varies by device, operating-system version and lock state. Claims that every message, deleted item or encrypted-app record is always recoverable go beyond what the bill, supplier profile and product documentation establish.

The legal and technical questions should stay separate. A DEAO can compel a person to provide a PIN, password, information, or biometric assistance. A forensic tool may then copy and organise data the device makes accessible. Neither the order nor the product guarantees that every locked phone can be opened, every deleted record can be recovered, or remote access is possible. The documented capabilities and limits of Cellebrite products are covered in Cellebrite phone extraction and the Serbia abuse case.

Practical device-risk steps

An actual direction or order needs case-specific advice from a criminal lawyer in the relevant state about the warrant, order, underlying seizure and any deadline. The steps below address device exposure and account continuity.

Primary sources

• NSW Parliament: bill First Print
• NSW Parliament: bill status
• NSW Hansard: second-reading speech
• NSW Government: proposed-powers release
• NSW legislation: LEPRA current text
• Victorian legislation: Crimes Act 1958
• Victorian legislation: 2022 amendment bill
• Victoria Hansard: 2022 digital-evidence reforms

Commentary reviewed

• Greens NSW: Organised crime reforms cover for attacks on civil liberties, 11 August 2026
• Michael West Media: NSW Police to seize mobile phone data without a warrant, 8 August 2026
• Green Left: NSW Police to be given powers to download phone content, 12 August 2026
• Victoria Legal Aid LawHub: property searches and mobile phones
• Victorian Sentencing Advisory Council: sentencing data for Crimes Act s 465AAA(5)
• ABC News: NSW Police Commissioner and minister on the proposed device-access power, 6 August 2026
• AAP: Push for more access in digital crime-fighting age, 6 August 2026
• Sydney Criminal Lawyers: NSW Police phone-content powers analysis, 31 July 2026
• Victorian Greens: debate on the bill that inserted s 465AAA, 2015
• Office of the Victorian Information Commissioner: examination of Victoria Police privacy and information-handling training, 2022

NSW bill status and all source pages checked 16 August 2026. Victorian legislation checked against authorised version 321, incorporating amendments as at 26 April 2026. This article will need a status update after the next NSW parliamentary stage, assent, amendment, or proclamation.