MR23 00109 22 107 C Drake IC Submissions.pdf

Your ref: MR22/00109
Our ref: FOI 22/107 IR

Department of Finance’s submissions to the Information Commissioner
Mr C Drake and the Department of Finance

1.  The Department of Finance (Finance) provides these submissions in response to the notice of
review issued in accordance with section 54Z of the Freedom of Information Act 1982 (FOI Act).

Issue

2.  Mr C Drake (the applicant) has sought an Information Commissioner (IC) review of the FOI
decision made on the Internal Review request 22/107 (‘the IC review’ and ‘the Internal Review
decision’).

3.  On 13 November 2022, the Department of Finance (Finance) received the applicant’s email
requesting access under the FOI Act to “the comprehensive list of all .gov.au domain names that
can be accessed by Australian taxpayers on the internet.”

4.  On 12 December 2022, Finance notified the applicant of the decision maker’s access refusal
decision, made on the basis that the document is exempt in full under section 45 of the FOI Act
(breach of confidence).

5.  On 12 December 2022, the applicant sought an internal review of Finance’s decision.

6.  On 11 January 2023, Finance notified the applicant of the decision maker’s decision to affirm the
original decision, being that “the Master List” is exempt in full under section 45 of the FOI Act.
It is this Internal Review decision that is subject to this IC review.

7.  Finance recognises an individual’s rights under and subject to the FOI Act to obtain access to
government documents and their inherent right for reviews in accordance with the FOI Act. In
this circumstance, Finance submits that the basis for this FOI review lacks merit and is
unreasonable. This is evident by the response of the applicant following the notice of decision by
Finance, the repeat requests for the same documents, including five separate requests, three
internal review requests, and three external reviews requests currently pending IC decision.

8.  Finance submits in these submissions that the document requested by the applicant is exempt
from disclosure under s45 of the FOI Act. This is because the document is subject to a
confidentiality clause in the 2LD Sub-Sponsorship Agreement for gov.au (1 July 2006), between
auDA and Finance, on behalf of the Commonwealth, and the .au Registry-Registrar Agreement
(dated 1 July 2018),) between Afilias and Finance, on behalf of the Commonwealth.

9.  Finance notes that the agreements referred to above that were in place at the time of the
applicant’s request have been superseded, and new agreements entered, as set out below:

•  the .au Registry-Registrar Agreement (2018) was superseded by the .au Registry-Registrar
Agreement, between Identity Digital Australia and Finance (dated 7 September 2022).
•  the 2LD Sub-Sponsorship Agreement for gov.au (2006) was superseded by the 2LD
Delegation Agreement for gov.au, between auDA and Finance (commencement date of 1
July 2023) with most recent extension on 28 June 2024.
•  The Commonwealth .au Domain Name Registrar Status Deed, between Finance, auDA and
Identity Digital Australia (commencement date 1 September 2022).
•  The auDA Registrar Agreement, between auDA and Finance (dated 7 September 2022)
with most recent extension on 28 June 2024.

Background

FOI 22/54
10.  On 25 July 2022, Finance received the applicant’s first request in a series, for access to the
following documents:

You operate the site https://www.domainname.gov.au/about which is the gov.au domain name
registration portal.
This portal in turn supplies registration data to the .au registry operator (Afilias Australia Pty
Ltd) who maintains a Master List of gov.au public domain names.
Please supply the current Master List, preferably in machine-readable format.
Note that F.o.I. rules require that you contact and/or negotiate with me if you encounter any
hurdles with the above; please make sure you do this if for any reason you find it difficult to
simply obtain (e.g. ask Afilias) and supply the above list.  Note also that historical "A-Z" sites
directories once existed in government, however, they were never complete, and all appear to be
taken down at present - I'm not interested in old or incomplete lists, I'm after the current Master
List as maintained by the registry.

11.  On 28 July 2022, Finance wrote to the applicant to acknowledge their request in accordance with
section 15(4)(a) of the FOI Act. Finance took this opportunity to provide the applicant with the
latest Australian Government Organisations Register (AGOR) data set which includes a
field for the website or webpage attributed to each listed entity. Finance also advised that
this data set is publicly available for download or access via API on data.gov.au from the
following page: Australian Government Organisations Register | Datasets | data.gov.au - beta.
Finance asked the applicant to withdraw his request.

12.  On the same date, the applicant advised that he would like to proceed with his original request
and stated:

Thanks for the alternative suggestion (and FYI - all of the web links online, including the one you
provided, are not functional - they all ultimately lead to "File not Found" errors).

The previous A-Z list included 992 gov.au domains as of 2017.  The attachment you provided
includes 295, and so appears to be far fewer than would exist as of now.

Since I'm seeking the actual comprehensive list, I would like to proceed with my original request.

13.  On 4 August 2022, the applicant provided further information regarding his request:
Note that a "domain name" is not the same thing as a "website address".  To clarify - the
information I am requesting will all exclusively end with ".gov.au" and nothing else.  Be aware that
my request is not limited to federal government websites - I'm seeking the current master list of
gov.au public domain names, as I requested originally.

The best way to fulfil my request is to get in touch with Afilias Australia Pty Ltd.  I've opened a case
with them, and all they need from you is the approval to send me the list.

Here is the case number and title of the ticket I opened:-
2

[.au Support - Case #01239018] The master list of gov.au public domain names.

Please include this text:-
ref:_00DD0CWb4._5004G2Ri8xw:ref
in the body of any email to send to them.

The contact you need to talk with is Abhinav Vatsavaya,
Email: xxxxxxx@xxxxxxx.xxx.xx
Phone: 03-9945-0650 (Australia)

Yours and many other departments will have this "master list" document somewhere already for
sure, however, since I'm seeking the current up-to-date version, the best, fastest, and easiest way to
ensure my FoI is properly answered is to get the current list from the registry source by asking
them using the above contact details.

14. On 8 August 2022, Finance sent the applicant a request consultation notice. The notice advised
the applicant that the work involved in processing his request in its current form would
substantially and unreasonably divert Finance’s resources from its other operations. The basis of
the practical refusal reason was that the decision maker considered that it would be necessary to
consult with each owner of a registered domain name and given the very large number of
consultations that this required, he intended to refuse the applicant’s request.

15. Subsequent to sending the request consultation notice, the decision maker considered that it was
more appropriate to refuse this request on the basis that the Master List was exempt in full under
section 45 of the FOI Act for breach of confidence.

16. On 23 September 2022, Finance notified the applicant of the decision maker’s access refusal
decision, made on the basis that the document is exempt in full under section 45 of the FOI Act.

17. On 24 September 2022, the applicant submitted an internal request of the original decision.

18. On 24 October 2022, Finance notified the applicant of the internal review decision maker’s
decision to affirm the original decision, being to find that the Master List is exempt in full under
section 45 of the FOI Act.

FOI 22/85
19. On 24 September 2022, the applicant submitted a new FOI request (FOI 22/85) for all
supporting document mentioned in the refusal of his original decision, FOI 22/54.

20. On 10 October 2022, Finance notified the applicant of the $164.42 preliminary assessment of
the charges payable by the applicant for Finance to process the request.

21. On 12 October 2022, the applicant outlined his contention of the preliminary assessment charge
and sought waiver of the charges.

22. On 1 November 2022, Finance notified the applicant of the decision maker’s decision to affirm
the preliminary charges notice.

23. On 15 November 2022, the applicant submitted an internal review request of the charges
decision.

24. On 13 December 2022, Finance notified the applicant of the internal review decision maker’s
decision not to waive or reduce the charge of $164.42.

3

FOI 22/107
25. On 13 November 2022, the applicant submitted a new FOI request (FOI 22/107) for:
the comprehensive list of all .gov.au domain names that can be accessed by Australian taxpayers
on the internet.

26. On 15 November 2022 and 16 November 2022, the applicant sent additional information
regarding his requests.

27. On 30 November 2022, Finance emailed the applicant to confirm the distinction between his
current this request (FOI 22/107) and previous requests (FOI 22/54 and FOI 22/85). That is,
Finance understood in the previous requests the applicant was seeking the.gov.au domain name
‘master list’. However, in the current request, he was instead seeking any publicly available list
of .gov.au domain names. In that email Finance provided the applicant with links to all publicly
available information that may contain the information that he was seeking. The information
provided is set out below under the headings, “A-Z List of Government Sites” and “Whole-of-
Australian Government Web Reporting Service.”

28. Finance requested that if the provided links contained the information that the applicant was
seeking, then we kindly ask that he withdraws his FOI request.

29. On 11 January 2023, Finance notified the applicant of the internal review decision maker’s
decision to affirm the original decision, being to find that the Master List is exempt in full under
section 45 of the FOI Act.

30. On 28 January 2023, the applicant sought a review of the internal review decision.

31. On 30 January 2023, Finance notified the applicant that there is no mechanism under the FOI
Act to seek a second review. Further, if the applicant sought to appeal Finance's internal review
decision, then he would need to make an application to the OAIC.

32. On 18 May 2023, Finance received an s 54Z notice of review by the Office of the Australian
Information Commissioner (OAIC).

Consideration

33.  In order to respond to the applicant’s submissions, an understanding of the “Master List” and
relevant parties is required, as defined below.

Master List
34. The Master List is a unique compilation of all gov.au domain names, which are unique
identifiers consisting of alphanumeric characters registered in the Designated Namespace.

35. The three key entities in relation to the Master List are:
•  auDA.
•  Finance, on behalf of the Commonwealth.
•  Identity Digital.
  36. The interconnection of the above entities and the terms that set out their roles and
responsibilities are set out in the Sponsorship Agreement and the Registry-Registrar Agreement.

auDA
37. auDA is a non-profit organisation that is the administrator of the .au country code Top Level
Domain under an agreement with the Internet Corporation for Assigned Names and Numbers
(ICANN). auDA is endorsed by the Commonwealth to administer the .au ccTLD as a secure,
4

accessible and trusted Australian public asset for all internet users. The .au domain name system
is designated as critical infrastructure under the Security of Critical Infrastructure Act 2018.

Finance
38. Finance represents the Commonwealth and operates as the registrar for gov.au names which
involves processing the data on behalf of registrants in the Registry.

Identity Digital
39. Identity Digital is the Registry Operator who provides Domain Name System (DNS) services for
domain names, which includes the receipt of data from registrars concerning registration of
domain names and name services. Identity Digital is responsible for making the WHOIS
registration data (WHOIS Data) accessible via the WHOIS website – https://whois.auda.org.au/,
which contains a ‘WHOIS Lookup’ function.

WHOIS
40. The WHOIS Data contains a list of registered domain names together with the following
information:
•  registrar of record for the domain name;
•  registrant of the domain name;
•  registrant contact name and email address;
•  technical contact name and email address;
•  name servers for the domain name.
  41. The WHOIS website provides a lookup service, this is distinguishable from a search engine. A
search engine, such as Google provides a search service, which will identify results both based
upon the literal words used but will also suggest results. For example, if you searched for
‘fince.gov.au’, the Google search engine produces a large number of results, with the top result
being a link to fincen.gov. This function of suggesting results does not exist in a lookup tool.

42. A lookup tool requires an exact data match. Using the same example, searching for
‘fince.gov.au’ will return a ‘NOT FOUND’ result. This means the user of the WHOIS Lookup
must type in the domain exactly as it is registered to return any result. In addition, there is no
option to obtain a compiled list of domain names. To obtain multiple search result, the user
would have to manually enter in multiple different domain names. Effectively, the user has to
already know the name of the domain name in order to return results.

43. Further, the WHOIS lookup service contains a Completely Automated Public Turing test to tell
Computers and Humans Apart (CAPTCHA). A CAPTCHA requires someone to correctly
evaluate and enter a sequence of letters or numbers perceptible in a distorted image displayed on
their screen. A CAPTCHA prevents automated software systems from running repeated
searches by creating a problem that is extremely difficult for software to decipher.

44. To use the WHOIS look up service, you are required to agree to the following terms and
conditions of use:

Identity Digital Australia Pty Ltd, for itself and on behalf of .au Domain Administration Limited
(auDA), makes the WHOIS registration data directory service (WHOIS Service) available solely for
the purposes of:
(a) querying the availability of a domain name licence;
(b) identifying the holder of a domain name licence; and/or
(c) contacting the holder of a domain name licence in relation to that domain name and its use.
The WHOIS Service must not be used for any other purpose (even if that purpose is lawful), including:
(a) aggregating, collecting or compiling information from the WHOIS database, whether for personal
or commercial purposes;
(b) enabling the sending of unsolicited electronic communications; and / or
5

(c) enabling high volume, automated, electronic processes that send queries or data to the systems of
Afilias, any registrar, any domain name licence holder, or auDA.
  45. The WHOIS Service is provided for information purposes only. By using the WHOIS Service,
you agree to be bound by these terms and conditions. The WHOIS Service is operated in
accordance with the auDA WHOIS Policy (available at https://www.auda.org.au/policy/2014-
07-whois-policy).

Publicly available information
46. On 28 July 2022, Finance provided the applicant, by email, the latest Australian Government
Organisations Register (AGOR) data set which includes a field for the website or webpage
attributed to each listed entity. That data set is publicly available for download or access via API
on data.gov.au from the following page: Australian Government Organisations Register |
Datasets | data.gov.au - beta.

47. On 30 November 2022, Finance provided the applicant, by email, links to the following:
•   the Australian Government directory, which lists corporate websites
(https://www.directory.gov.au/).
•  the ‘A-Z list of government sites’ which was previously published on australia.gov.au at
https://www.australia.gov.au/about-government/departments-and-agencies/a-z-of-
government-sites, however this page is no longer available.
•  Information on the Whole-of-Australian Government Web Reporting Service. As part of a
separate project, the Digital Transformation Agency undertook a Whole-of-Australian
Government Web Crawl in 2018 (refer to the blog post ‘WofG Web Reporting Service -
Crawl Data’ available at https://blog.data.gov.au/news-media/blog/wofg-web-reporting-
service-crawl-data).

48. Finance submits that the above publicly available information was curated and maintained by
either the Department of Finance, or the Digital Transformation Agency. As such, the publicly
available information is not the Master List.

Applicant’s submission
49. The applicant submits in his IC review application that:

"Confidentiality" is claimed, but this does not apply.
1. There is no legitimate reason for the information I requested to be "confidential" in the first
place.
2. It's made available in the public DNS and other places, making it exempt from confidentiality
3. The confidentiality claimed does not apply to the Government (only the outsourced provider),
so the government is allowed to let me have it.
4. Other sources of this information exist which are not covered by any confidentiality.
5. The government has no right to enforce "confidentiality" on the information it handles and then
use that claim to deny an FoI request.
6. Finance refused to substantiate any of their confidentiality claims, and attempted retribution
when I asked (tried to force me to pay with fake time estimate, knowing full well that they were
still not going to release the information I wanted anyhow).
7. Claims of "confidentiality" are invalid when not accompanied by legitimate reasons - none of
which they provided.
8. They asked for a time extension, which was not used for the purpose they requested it, but
instead was used to negotiate with the outsourced party to put in place a confidentiality
agreement for the purposes of refusing my request.
9. Refusal in this instance is corrupt behavior: the only reason they are not releasing the list, is
because they know that doing so will embarrass many government departments - this is not a
legitimate FoI refusal reason. "Confidentially" is a fake reason manufactured to disguise the real
reason of embarrassment.
10. I asked for any list they have, but they're claiming confidentiality over only one source of this
list, and ignoring the fact they can get it from elsewhere without confidentiality if they wanted.
6

11. At the time that I made the request, the information I sought was not confidential.

Finance’s responses to applicant’s contentions
50. In response to the applicant’s contention that “"Confidentiality" is claimed, but this does not
apply” Finance submits that the five necessary criteria are satisfied in relation to the Master
List, that would find an action for breach of confidence (section 45 of the FOI Act), by auDA.
The elements and facts for this exemption are set out in detail below, from paragraph 68.

51. In response to the applicant’s contention that “There is no legitimate reason for the information
I requested to be "confidential" in the first place”, Finance submits that auDA, Identity Digital,
and Finance, on behalf of the Commonwealth have legally binding relationships as set out in the
Sponsorship Agreement and the Registry-Registrar Agreement. These “contracts” include
confidentiality clauses which Finance are bound by.

52. In response to the applicant’s contention that “It's made available in the public DNS and other
places, making it exempt from confidentiality” Finance submits that Master List has maintained
its quality of confidence as it is only known to a limited group and not in the public domain.
This is evidenced by the existence of the multiple FOI requests submitted by the applicant.

53. Finance further submits that some .gov.au domains that are not known to the public or disclosed
to the public by name, such as domains not currently used or not linked to websites in the World
Wide Web. These domain names cannot be searched for or located through search engines such
as Google.

54. Finance notes that while some public data sets were accessible in part on the A-Z List of
Government Sites or the Australian Government Directory (https://www.directory.gov.au/) these
were specifically curated, and again, not the Master List.

55. Finance provided the applicant with publicly available information, as set out above from
paragraphs 46 to 48. However, as this was not the Master List, the applicant was not satisfied
with this information.

56. In response to the applicant’s contention that “The confidentiality claimed does not apply to the
Government (only the outsourced provider), so the government is allowed to let me have it”,
Finance submits that it is given access to the Master List on a confidential basis under the
Sponsorship Agreement and is required to keep the Master List confidential. The confidentiality
clause in the Sponsorship Agreement is binding on Finance, therefore, Finance is not able to
release the Master List.

57. In response to the applicant’s contention that “4. Other sources of this information exist which
are not covered by any confidentiality”, Finance contends, in addition to the reasoning as set out
in paragraph 19 – 21, the Master List is only known by auDA, Identity Digital and specific staff
in Finance. Although individual domains contained in the Master List are in the public domain,
the Master List is not and is kept intentionally confidential, due to the nature of the information.

58. In response to the applicant’s contention that “The government has no right to enforce
""confidentiality" on the information it handles and then use that claim to deny an FoI request”,
Finance submits that, as set out in paragraph 23, Finance is bound by the confidentiality clause
in the Sponsorship Agreement.

59. In response to the applicant’s contention that “Finance refused to substantiate any of their
confidentiality claims, and attempted retribution when I asked (tried to force me to pay with fake
time estimate, knowing full well that they were still not going to release the information I
wanted anyhow)”, Finance submits that the decision letter provided a statement of reasons
establishing that to release the Master List would found an action breach of confidence (section
7

45 of the FOI Act),by auDA. Again, the elements and facts for this exemption are set out in
detail below, from paragraph 68.

60. On 10 October 2022, Finance issued the applicant with a preliminary charge notice of $164.42
to process his request for FOI 22/85, in accordance with the Freedom of Information (Charges)
Regulations 2019. On 12 October 2022, the applicant outlined his contention of the preliminary
assessment charge and sought a waiver of the charge. On 1 November 2022, Finance notified
the application of the decision maker’s decision to affirm the preliminary charge. On 13
November 2022, the applicant sought an internal review of Finance decision of the charges
payable. On 13 December 2022, Finance notified the applicant that the decision maker had
decided not to waive or reduce the charge. Finance submits that both the charges decision letter
and the internal review of charges decision letter sets out how and why the charge was
calculated, nothing that the documents the applicant requested predominately consist of legal
contracts, which requires careful assessment, amongst other findings.
61. In response to the applicant’s contention that “Claims of "confidentiality" are invalid when not
accompanied by legitimate reasons - none of which they provided”, Finance submits, as above,
the statement of reasons established the application of the exemption.

62. In response to the applicant’s contention that “They asked for a time extension, which was not
used for the purpose they requested it, but instead was used to negotiate with the outsourced
party to put in place a confidentiality agreement for the purposes of refusing my request”,
Finance denies this allegation. Finance submits that the extension of time was to consult with
auDA and Identity Digital, as relevant third parties, they must be provided with reasonable
opportunity to make a submission that the document is exempt from disclosure.

63. Finance notes that on 4 August 2022, in the course of the applicant’s first request for the Master
List , the applicant stated:

The best way to fulfil my request is to get in touch with Afilias Australia Pty Ltd. I've opened a case
with them, and all they need from you is the approval to send me the list.

64. The applicant was of the view that Identity Digital (formerly Afilias) was supportive of Finance
releasing the Master List to him. However, this was inconsistent with the information that has
been provided directly to Finance by Identity Digital. auDA and Identity Digital jointly objected
to the disclosure of the Master List.

65. In response to the applicant’s contention that “Refusal in this instance is corrupt behavior: the
only reason they are not releasing the list, is because they know that doing so will embarrass
many government departments - this is not a legitimate FoI refusal reason. "Confidentially" is a
fake reason manufactured to disguise the real reason of embarrassment”, Finance denies this
allegation. The Master List has not been released as doing so would found an action breach of
confidence, as set out above.

66. In response to the applicant’s contention that “ I asked for any list they have, but they're
claiming confidentiality over only one source of this list, and ignoring the fact they can get it
from elsewhere without confidentiality if they wanted”, Finance submits that the Master List is
not publicly available. Finance has tried to assist the applicant by providing various links to
publicly available information, as set out in paragraphs 46 to 48, however, the applicant is not
satisfied with the publicly available information.

67. In response to the applicant’s contention that “At the time that I made the request, the
information I sought was not confidential”, Finance submits that this is incorrect. The Master
List has always remained confidential, as set out in paragraph 86 below.

8

Finance’s submission
68. Section 45 of the FOI Act provides (relevantly):
(1)  A document is an exempt document if its disclosure under this Act would found an action, by
a person (other than an agency or the Commonwealth), for breach of confidence.

69. The FOI Guidelines [5.158] state that:
A breach of confidence is the failure of a recipient to keep confidential, information which has been
communicated in circumstances giving rise to an obligation of confidence. The FOI Act expressly
preserves confidentiality where that confidentiality would be actionable at common law or in
equity.1
  70. The FOI Guidelines [5.159] further state that:

To found an action for breach of confidence (which means section 45 would apply), the following
five criteria must be satisfied in relation to the information:
•  it must be specifically identified
•  it must have the necessary quality of confidentiality
•  it must have been communicated and received on the basis of a mutual understanding of
confidence
•  it must have been disclosed or threatened to be disclosed, without authority
•  unauthorised disclosure of the information has or will cause detriment. 2

71. Finance submits that the Master List meets the five criteria to establish that disclosure of which
under this Act would found an action for breach of confidence, by auDA.

Specifically identified
72. The FOI Guidelines [5.161] state that:
The alleged confidential information must be identified specifically. It is not sufficient for the
information to be identified in global terms. 3

73. In 'XF' and Australian Radiation Protection and Nuclear Safety Authority [2021] AICmr 21
(4 June 2021) (XF) a confidentiality clause contained in a Memorandum of Understanding that
specifically identified what information was confidential, was found to satisfy this criteria.

74. The applicant’s request is limited to the Master List, which is specifically identified and not a
general term.

75. The Sponsorship Agreement and the Registry-Registrar Agreement specifically identifies the
information that is confidential, which includes the information that is contained in the Master
List.

76. Finance submits the first element, that the Master List is specifically identified, is satisfied.

Quality of confidence
77. The FOI Guidelines [5.162] state that:

For the information to have the quality of confidentiality it must be secret or only known to a
limited group. Information that is common knowledge or in the public domain will not have the
quality of confidentiality. 4

78. The Master List can only be accessed by a limited number of people, who require access to
perform their roles and have either a contractual, statutory or equitable duty of confidence:

1 FOI Guidelines at [5.158].
2 FOI Guidelines at [5.159].
3 FOI Guidelines at [5.161].
4 FOI Guidelines at [5.162].
9

•  Finance for the purpose performing its functions as registrar;
•  auDA as the administrator of the .au ccTLD; and
•  Identity Digital, as the .au registry operator.

79. Finance can request reports for gov.au names from auDA or Identity Digital, such as the Master
List, in its role as registrar under the Sponsorship Agreement. However, any such reports, are
disclosed in confidence. Finance is also required to not do anything which may adversely affect
or compromise integrity or stability of the internet domain name system. On this basis, access to
the Master List is restricted within Finance, and only parties who have involvement in Finance
performing its functions as Registrar have access.

Accessibility of individual domain names
80. Deputy President J Sosso in Francis and Australian Sports Anti-Doping Authority (Freedom of
Information) [2019] AATA 12 (4 January 2019) considered the degree at which information has
entered the public domain, being relevant to establishing whether a document possessed the
quality of confidence. The Deputy President J Sosso referred to the following sections of the
decision of  the Court of Appeal of Singapore, Wee Shuo Woon v HT RSL [2017] SGCA 23 (30
March 2017) (Woon):

Ultimately, it is very much a commonsense inquiry whether the information has become so
accessible and/or accessed that it would not be just in all the circumstances to require the party
against whom confidence is asserted to treat it as confidential. 5
Further, it is important to focus not only on the extent to which the information in question has
become accessible but also on the extent to which it has in fact been accessed by the general public.
As we have said, the essence of a confidence or secret is that it is not publicly known. Potential,
abstract accessibility is vastly different from access in fact. This is particularly so, given the
proliferation of information in the globalised Internet age of today. Paradoxically, much of the
information on the Internet, although accessible, is not in fact accessed by the public, whether from
lack of interest or time or even ignorance. 6
Accordingly, the circumstances of each case must be examined. Consideration must be given to
such factors as the likelihood of the information being accessed by the public, the degree to which
the information has in fact been accessed and the extent to which the information may be
appreciated and/or understood only with the specialised skills or expertise of the party seeking to
make use of the information. Merely making confidential information technically available to the
public at large does not necessarily destroy its confidential character. Public media, in particular the
Internet, must not be the gateway through which all confidentiality is dissolved and destroyed. 7

81. Deputy President J Sosso went on to cite Woon with approval:

As was highlighted by the Court of Appeal in Woon, even if information has entered into the public
domain it does not necessarily follow that it has lost its confidential character. It is only if
information has become public knowledge that, as a matter of common sense, the confidential
character of the information disappears. The Court of Appeal, properly and eloquently, highlighted
the practical and common sense nature of the inquiry required. 8

82. The WHOIS lookup tool enables users to access one domain name at a time that is registered on
the WHOIS database, however, Finance submits that abstract accessibility is vastly different to
access in full to the Master List of domain names.

83. As discussed from paragraph 41 above, the WHOIS lookup tool requires the user to already
know the domain name to return a result. Further, the disclaimer listed underneath the WHOIS
lookup tool contains terms and conditions of use, including:

5 at 107 citing Woon paragraph 35.
6 at 108 citing Woon paragraphs 36-37.
7 at 108 citing Woon paragraphs 36-37.
8 at 124.
10

The WHOIS Service must not be used for any other purpose (even if that purpose is lawful),
including: (a) aggregating, collecting or compiling information from the WHOIS database, whether
for personal or commercial purposes.

84. In the situation whereby a user disregarded the terms and conditions of use by attempting to
aggregate, collect or compile information from the WHOIS database through the use of an
automatic software to run multiple searches, they would be frustrated by the existence of the
CAPTCHA.

85. Finance submits that although most individual domain names are technically publicly accessible
through the use of the WHOIS lookup tool, due to the prerequisite knowledge required to obtain
access, the information is not broadly publicly accessible in any real sense.

Quality of confidence – conclusion
86. Finance submits that the aggregate of the domain names, being the Master List, is not publicly
accessible, and all parties have maintained the Master List has not been provided to any parties
beyond those required to have access to perform their contractual obligations. Accordingly,
Finance submits the second element, that the Master List has the necessary quality of
confidentiality, is satisfied.

Mutual understanding of confidence
87. The FOI Guidelines [5.164] state that:

The information must have been communicated and received on the basis of a mutual
understanding of confidence. In other words, the agency needs to have understood and accepted an
obligation of confidence.https://www.oaic.gov.au/freedom-of-information/foi-guidelines/part-5-
exemptions/ The mutual understanding must have existed at the time of the communication. The
most obvious example is a contractual obligation of confidence. 9

88. In B and Brisbane North Regional Health Authority [1994] QICmr 1 (B) the QIC F N Albietz
reviewed the relevant legal authorities:
[84] … the fundamental inquiry is aimed at determining, on an evaluation of the whole of the
relevant circumstances in which confidential information was imparted to the defendant, whether
the defendant's conscience ought to be bound with an equitable obligation of confidence. The
relevant circumstances will include (but are not limited to) the nature of the relationship between
the parties, the nature and sensitivity of the information, and circumstances relating to its
communication …

89. The following factors are relevant to establishing that a mutual understanding of confidence
existed at the time the information was communicated, and that this obligation of confidence
continues to exist:
•  The Sponsorship Agreement has confidentiality provisions.
•  The actions of Finance, auDA and Identity Digital demonstrate that all parties accepted the
obligation of confidence and have acted in accordance with the confidentiality.

90. Finance submits that both auDA and Finance have agreed to the confidentiality requirements in
clause 8 of the Sponsorship Agreement. Therefore, there is a clear mutual understanding that the
Master List is to remain confidential.

91. Finance further submits that the Master List in only accessed by Finance in accordance with the
mutual understanding of confidence that exists between the parties.

9 FOI Guidelines at [5.164].
11

92. Finance submits the third element, that the Master List was communicated and received on the
basis of a mutual understanding of confidence, is satisfied.

Unauthorised disclosure or threatened disclosure
93. The FOI Guidelines [5.169] state:

For example, the agency may have told the person providing the information about the people to
whom the agency would usual y disclose such information. The law may require disclosure to third
parties in the performance of an agency’s functions, which will amount to authorised use and/or
disclosure. Similarly, a person providing confidential information to an agency may specifically
permit the agency to divulge the information to a limited group.

94. The prospect of confidential information being released under the FOI Act would constitute an
unauthorised threatened disclosure under the Sponsorship Agreement. Through third party
consultation auDA has responded that it does not consent to the disclosure,

95. Finance submits the fourth element, that the Master List, as part of this FOI request is threatened
to be disclosed, without authority, is satisfied.

Detriment
96. The FOI Guidelines [5.171] state:

The fifth element for a breach of confidence action is that unauthorised disclosure of the
information has, or will, cause detriment to the person who provided the confidential information.

97. In B and Brisbane North Regional Health Authority [1994] QICmr 1 (B) the QIC F N Albietz
reviewed the relevant legal authorities:

[111] … It appears, however, that detriment is fairly easily established. In particular, it is not
necessary to establish that threatened disclosure will cause detriment in a pecuniary
sense: "detriment can be as ephemeral as embarrassment ..  a loss of privacy or fear ..  and indirect
detriment, for example, the confidential information may gravely injure some relation or
friend." (see Dean, p.177-8 and the cases there cited for these propositions). Moreover, in Attorney-
General v Guardian Newspapers (No.2) [1990] 1 AC 109, Lord Keith of Kinkel (with whom Lord
Jauncey agreed) said (at p.256):

"I would think it a sufficient detriment to the confider that information given in confidence is to be
disclosed to persons to whom he would prefer not to know of it, even though the disclosure would
not be harmful to him in any positive way."

98. The disclosure of the Master List will cause detriment to auDA, Identity Digital and Finance as
the Master List is kept intentionally confidential. Its release puts the gov.au namespace at risk of
targeted cyber-attacks and would adversely affect or compromise integrity or stability of the
internet domain name system. For example, release of the Master List could be used for
malicious purposes such as systematically using vulnerability scanning tools against the list to
identify security vulnerabilities, or compiling lists of email addresses for use in spear-phishing
attacks.

99. The release of the Master List would undermine Finance’s reputation by having a deleterious
effect on third parties’ confidence in Finance honouring its obligations of confidentiality in the
future.

100.  Finance submits that the disclosure of the Master List would have a detrimental effect on
Finance, auDA and Identity Digital.

101.  Finance submits the fifth element, that unauthorised disclosure of the Master List will cause
detriment, is satisfied.
12

Conclusion

102. Finance submits that the Master List is exempt in full under section 45 of the FOI Act. The
consulted third parties considered that sections 33, 42, 45 and 47G of the FOI Act also apply to
exempt the Master List in full.

Further consultation

103. Finance is able to provide further submissions or meet to discuss in the event that would be
helpful to this review.

Kind regards,
Freedom of Information Officer
Public Law Section
Department of Finance

13