Legal Analysis: Can NSW Police Really Download Your Entire Phone on the Street?

Social media has recently been awash with claims that police in New South Wales now possess spyware capable of taking everything from a person's mobile phone: every message, every telephone call, photographs, contacts, locations and perhaps even material stored in the cloud. Some versions go further. They say police can do this whenever they stop somebody on the road, and occasionally the story is expanded further still into the claim that police can effectively scan people merely walking down the street and dump their communications into a government database. There is a real story underneath all of this, and it deserves scrutiny. But the viral version has merged several quite different technologies and legal powers into something resembling a science-fiction surveillance machine. As of September 2026, NSW Police do not possess a general legal power to approach an ordinary citizen, remotely infect his telephone with spyware and download every communication simply because he happens to be walking along a public street.

What NSW does have is an increasingly powerful legal architecture for getting into digital devices when police have sufficient grounds. NSW has had Digital Evidence Access Orders since 2022. Under Division 4A of Part 5 of the Law Enforcement (Powers and Responsibilities) Act 2002, an authorised officer may obtain an order requiring a specified person to provide information or assistance necessary to access data held in, or accessible from, a computer. For these purposes a smartphone is effectively a computer. The existing legislation expressly contemplates requiring assistance with biometric security such as fingerprints. Failure to comply without reasonable excuse can presently attract a maximum of five years' imprisonment.

That is already a substantial state power, but under the existing law the Digital Evidence Access Order is generally connected with a search warrant or crime-scene warrant. An issuing officer must be satisfied that there are reasonable grounds for suspecting that evidential material is held in, or accessible from, the device. The person against whom the order is directed must also fall within categories specified by the legislation, such as a suspected offender, owner or user of the computer, or somebody with relevant knowledge of its security.

The source of much of the present alarm is a further NSW Government bill introduced on 6 August 2026, the Crimes and Other Legislation Amendment (Further Organised Crimes Reforms) Bill 2026. The Government announced that it wants to detach a new form of Digital Evidence Access Order from the requirement for an accompanying search or crime-scene warrant in certain organised-crime investigations. The Government itself gave examples including devices lawfully seized during an arrest, roadside stop or other lawful detention.

That phrase: "roadside stop," is almost certainly one of the sources of the social-media explosion. But it does not mean that a traffic officer can pull over Mrs Jones for a defective tail-light and casually demand the contents of her iPhone. According to the Government's own description, the expanded order concerns digital devices suspected of association with prescribed serious offences linked to organised crime, including serious drug supply, illicit tobacco activity, fire-bombings and public-place shootings. The phone must first have been lawfully seized, and police must then obtain the relevant Digital Evidence Access Order.

There is another important qualification that has largely disappeared online. As of 12 September 2026, this latest expansion is still a bill, not yet an operative Act. The NSW Parliament records the Further Organised Crimes Reforms Bill 2026 as remaining in the Legislative Assembly at the second-reading stage, debate having been adjourned after its introduction on 6 August.

So, posts saying that every NSW police officer already possesses this new roadside power are getting ahead of Parliament. Nor is "spyware" necessarily the right description. Police forces do possess sophisticated digital-forensic equipment capable of extracting enormous quantities of information from seized mobile phones. Depending upon the device, its security and the forensic technology available, an extraction may recover messages, call histories, contacts, photographs, application data and other material resident on the phone. An unlocked smartphone can reveal an extraordinary portion of somebody's private life.

But forensic extraction from a phone physically or lawfully obtained is not the same thing as remotely installing Pegasus-style spyware on everybody encountered by police. The August NSW bill is fundamentally legislation about compelling access to a device. It does not itself create some magical new technological ability to monitor every Australian phone remotely.

A second source of confusion is telecommunications metadata. Under the Commonwealth Telecommunications (Interception and Access) Act 1979, authorised enforcement officers can in defined circumstances obtain telecommunications data from carriers. Section 178 permits access to existing telecommunications information where an authorised officer considers disclosure reasonably necessary for enforcement of the criminal law. But Chapter 4 expressly distinguishes this information from the contents or substance of communications.

That distinction is critical. Telecommunications data may tell authorities that telephone A communicated with telephone B at a particular time, for a particular duration, or through a particular service. It is commonly called metadata. It does not automatically reveal what the two people said to one another. Commonwealth material published in August 2026 specifically explains that telecommunications data can include the time, date and duration of a communication or the service from which it was sent, but does not include the content of an SMS or email.

Actual interception of communications and access to certain stored communications operate under separate warrant regimes. The Commonwealth Act contains a dedicated stored-communications warrant system for criminal law-enforcement agencies.

Thus, three quite different things are being bundled together online: forensic extraction of information already on a seized telephone; telecommunications metadata obtained from telecommunications providers; and interception or covert surveillance of communications. They are governed by different powers, thresholds and warrant procedures.

There is also no evidence in the NSW legislation of a general database into which the complete communications of every person stopped by police are automatically deposited. Information lawfully extracted during investigations can obviously be retained as police evidence and managed through police digital-evidence systems, subject to the legislation and applicable retention rules. NSW surveillance law itself requires records obtained through surveillance-device warrants to be securely kept and provides for destruction where the material is no longer likely to be required for authorised purposes.

Some of the "database" language may also be becoming confused with another part of the August bill. The NSW Government simultaneously proposed joining the Commonwealth national Face Matching Services system and making NSW driver-licence and photo-card images available through the National Driver Licence Facial Recognition Solution. That really is a national identity-matching infrastructure, but it is not a database containing everyone's phone conversations. South Australia and Western Australia are already connected to that facial-recognition system.

What, then, about South Australia? South Australian police certainly possess significant digital-access powers of their own, but the NSW August proposal does not automatically apply in South Australia. State police powers arise substantially from separate state legislation.

Part 16A of South Australia's Summary Offences Act 1953 deals expressly with "Access to data held electronically." Its definition of computer includes tablets, mobile phones and other internet-capable electronic devices. Data held on a device can also include data on a remote computer or remote storage system, such as cloud storage, where it is accessible from that device.

South Australian law also permits orders requiring information or assistance to obtain access, and the legislation specifically contemplates fingerprints, retinal scans and facial scans. In urgent circumstances police may apply to a magistrate by telephone and can, under specified conditions, require a person reasonably suspected of the relevant offence to remain at a place or accompany police to a station while the application is dealt with. The current Act places judicial involvement between police suspicion and compulsory access rather than creating a general stop-and-download power.

South Australia separately operates under the Surveillance Devices Act 2016. That Act provides warrant mechanisms for tracking and other surveillance devices and requires consideration of such matters as the gravity of the criminal conduct and the availability of alternative means of obtaining the information.

And because telecommunications interception is largely governed federally, Commonwealth telecommunications legislation applies across Australia. SAPOL, just like NSW Police, operates within that national telecommunications framework when seeking carrier-held telecommunications information.

The fact-check therefore comes out somewhere between complacency and panic. The claim that NSW police can now secretly scan everybody's telephone merely because they stop them on the street is false. There is no general legislative licence to vacuum up every message and telephone conversation belonging to arbitrary pedestrians. The highly publicised new NSW roadside proposal is targeted at lawfully seized devices associated with prescribed organised-crime offences and, as of 14 September 2026, remains before Parliament rather than being operative law.

But the underlying civil-liberties question is real. Modern smartphones are no longer equivalent to the wallet or notebook that police might once have found in someone's pocket. They can contain years of correspondence, photographs, browsing activity, financial records, movements, personal relationships and access credentials to remote data. Giving the state power to compel a person to unlock such a device is therefore vastly more intrusive than an old-fashioned pocket search.

The most important issue is not whether police possess an imaginary button labelled "download everybody." They do not. It is whether the accumulation of individually limited powers: device seizure, compelled unlocking, biometric access, forensic extraction, telecommunications metadata, surveillance warrants, facial-recognition databases and increasingly sophisticated digital-analysis tools, eventually produces something approaching comprehensive surveillance when the pieces are put together.

That is a much stronger criticism because it does not require exaggeration. The law is already powerful enough without turning it into mythology.

Oh, even the worst-case street stop scenario does not bother me personally, as I don't use a mobile phone at all. If I need to make a call, I use a free public phone! A surveillance architecture built around universal smartphone dependence has encountered its natural predator: the man without a smartphone!