Bills Digest No. 9, 2017-18
PDF version [1,623KB]
Monica Biddington and Jaan Murphy
Law and Bills Digest Section
8
August 2017
Contents
The Bills Digest at a glance
Purpose of the Bill
Structure of the Bill
Background
2013 PJCIS report
2015 PJCIS report
2016 Australian Cyber Security
Strategy
Committee consideration
Parliamentary Joint Committee on
Intelligence and Security
Senate Standing Committee for the
Selection of Bills
Senate Standing Committee for the
Scrutiny of Bills
Policy position of non-government
parties/independents
Opposition
Other non-government parties and
independents
Position of major interest groups
Previous consideration of TSSR and
position of interest groups
Current position of major interest
groups
Joint submission from industry
associations
Australian Centre for Cyber Security
The Bill and the Metadata Act
Financial implications
Statement of Compatibility with Human
Rights
Parliamentary Joint Committee on
Human Rights
Key issues and provisions
Administrative guidelines
Over-the-top services
Security obligations
Concerns about the use of the ASIO
Act definition of security
Key definitions underpinning the
security obligations
The security obligations generally
Table 1: security obligations
Immunity from liability
Elements of the security obligation
Meaning of ‘do their best’ element of
the security obligations
Security obligations and their
application
The definition of ‘facility’ and the
security obligations
Concerns about retrofitting
Notification regime—overview
Individual notifications
Annual Security Capability Plans
Interaction between SCPs and
individual notification regime Annual Security Capability Plans
Assessment of notified proposed
changes
Criticism of notification regime
Logic of the approach
Asymmetry of the notification
requirements
Inconsistency with the direction
regime
Length of time to finalise a decision
Unnecessary interference with
commercial decisions of carriers and CSPs
Offshoring
Unclear thresholds and unnecessarily
broad scope of application
Directions by the Attorney-General
Current position
Power to require a carrier or CSP to
cease operating a telecommunications service
Power to require a carrier, CSP or
intermediary to do or refrain from doing a specified act
Criticisms of the directions powers
Potential to undermine investment
decisions and reduce competition
Inappropriate weighting given to
adverse security assessments
The impact of uncertain definitions
and the opacity of adverse security assessments
Lack on consultation requirement in
shutdown power
Information gathering and sharing
powers
Power to obtain information or
documents
Content of notice to produce
information or documents
Availability of compensation
Abrogation of privilege against
self-incrimination
Information sharing
Criticisms of the information
gathering and sharing powers
Reporting and oversight
Concluding comments
Date introduced: 9
November 2016
House: Senate
Portfolio: Attorney-General
Commencement: 12
months after the date of Royal Assent.
Links: The links to the Bill,
its Explanatory Memorandum and second reading speech can
be found on the Bill’s home page, or through the Australian
Parliament website.
When Bills have been passed and have received Royal Assent,
they become Acts, which can be found at the Federal Register of Legislation
website.
All hyperlinks in this Bills Digest are correct as
at August 2017.
The Bills Digest at a glance
Purpose of the Bill
- The
purpose of the Bill is to create a regulatory framework for industry and
government to collaboratively manage national security risks of espionage,
sabotage and foreign interference to Australia’s telecommunications networks
and facilities.
- The
Bill will provide the Attorney-General with a new power to direct a carrier or carriage
service provider (CSP) or a carriage service intermediary (intermediary) to do
or not do a specified thing on security related grounds (for example, alter a
procurement assessed as giving rise to security risks).
Background
- The
proposed measures in the Bill form part of a package of reforms to national
security legislation, identified by the former government in 2012, commonly
referred to as Telecommunications Sector Security Reforms (TSSR). The TSSR is the
process of developing regulatory mechanisms to ensure that industry engages
with security agencies to enable the early identification and collaborative
management of security risks in their infrastructure, and information held on
or carried over it.
- TSSR
has been an issue of sustained parliamentary and industry interest and
consideration, including inquiries by the Parliamentary Joint Committee on
Intelligence and Security (PJCIS) in 2012–13 and 2014–15 and public
consultations on two exposure draft Bills released by the Government in 2015.
- The
overall intent and objectives of the Bill reflect and are largely consistent
with recommendations of the PJCIS on TSSR related measures, and Government responses
to those recommendations.
Stakeholder concerns
- Stakeholders
have expressed concerns including that because the regime favours security interests
over commercial or competition interests, it is an inappropriate intrusion into
the commercial decision-making of telecommunications companies’ that will undermine
sound investment decisions and reduce innovation in the sector.
- In
addition to raising in-principle concerns about the Bill, some stakeholders
have supported amendments to specific provisions of the proposed regime,
generally to strengthen safeguards, place limits on administrative discretions
and enhance protections for commercially sensitive information that may be
required to be disclosed under the proposed framework.
- Some
members of the PJCIS questioned whether the Bill contains adequate mechanisms to identify the amount of data held by Australian
telecommunications companies that is stored offshore (commonly referred to as
’offshoring’) and ensure its protection.
Key elements
- The
regime will have a delayed commencement (12 months), including the development
of administrative guidelines website.[1]
- The
regime established by the Bill will apply to carriers, CSPs and intermediaries
to varying degrees.
- A
new security obligation is imposed on carriers and CSPs to ‘do their best’ to
manage risks related to unauthorised access and interference to networks and
facilities they own, operate or use to ensure the availability and integrity of
networks and facilities and to protect the confidentiality of information
stored on and carried across them.
- A
new notification requirement is imposed on carriers and certain CSPs to notify
the government of planned changes to their systems and services that are likely
to make the network or facility vulnerable to unauthorised access and
interference.
- The
Secretary of the AGD is provided with coercive information gathering powers in
relation to carriers, CSPs and intermediaries subject to the new regime to
facilitate monitoring of and investigations into compliance with the new security
obligations.[2]
Key issues for debate
- The scope of key definitions including applying
all components of the definition of ‘security’ in the Australian Security Intelligence Organisation
Act 1979 (the ASIO Act) to the new security
obligations and notification requirements in proposed sections 313(1A) and (2A), rather than specifically limiting it to the components of the
definition listed in the notes to the provisions contained in the Bill.
- The suitability and breadth of application of the new security
obligations.
- The compliance burden and risk associated with the notification
obligation.
- The adequacy of the threshold that must be satisfied (and matters
to be considered) before the directions or shutdown power can be used by the
Attorney-General requiring a carrier, CSP or intermediary to do, or refrain
from doing, a specified act or thing (or ceasing to supply a carriage service).
-
The application of the regime to web-based
email, voice over internet protocol (VoIP) and cloud computing services.
- The adequacy of safeguards in relation to compulsory disclosure
and information-sharing powers, including:
- potential limitations in the protections available for the secondary
disclosure of information for the purposes of security under proposed section
315H(1)(b) and
- possible ways in which protections of commercially sensitive
information could be
strengthened under the proposed information-sharing arrangements in proposed
section 315H (both
legislative and administrative).
- The
adequacy of the oversight and reporting requirements in
relation to the operation of the proposed scheme and
- The collection of data offshore(and more specifically, the storage
of data required to be retained under the Telecommunications
(Interception and Access) Act 1979 (the TIA Act).
Purpose of the Bill
The purpose of the Telecommunications and Other
Legislation Amendment Bill 2016 (the Bill) is to amend the Telecommunications
Act 1997 (the Act), TIA Act, ASIO Act and the Administrative
Decisions (Judicial Review) Act 1977 (the ADJR Act) to provide
a regulatory framework for industry and government to collaboratively manage national
security risks of espionage, sabotage and foreign interference to Australia’s
telecommunications networks and facilities.[3]
It does so by:
- imposing a new security obligation on carriers and CSPs to ‘do
their best’ to manage risks related to unauthorised access and interference to
networks and facilities they own, operate or use to:
- ensure
the availability and integrity of networks and facilities and
- to
protect the confidentiality of information stored on and carried across them
-
imposing notification requirements on carriers and certain nominated
CSPs (‘NCSPs’) to notify the government of planned changes to their systems and
services that are likely to make the network or facility vulnerable to
unauthorised access and interference
- providing
the Secretary of the AGD with information gathering powers to facilitate
monitoring of and investigations into compliance with the new security
obligations
- providing
the Attorney-General with two directions powers (subject to certain conditions
being met) to:
- direct a carrier or CSP to do or not to do a specified thing (the ‘directions power’), for
example, alter a procurement assessed as giving rise to security risks or
- shut down a specific service (the ‘shutdown power’) and
- providing enforcement mechanisms by extending the civil remedies
regime provided for in Part 30 (injunctions), Part 31 (civil penalties), and
Part 31A (enforceable undertakings) of the Act to address non-compliance with
the security obligations, a Ministerial direction, or notice to produce
information or a document.[4]
Structure
of the Bill
This Bill has one Schedule, divided into three parts.
Part 1 contains the main amendments to the Act and TIA Act
to implement the new framework, which relate to the security obligations,
notification obligations and requirements, information gathering powers, the directions
and shutdown powers of the Attorney-General and the enforcement mechanisms.
Part 2 contains consequential amendments to the ASIO Act
and ADJR Act with respect to the issuing of security assessments for the
purpose of the new regime, and the statutory judicial review of Ministerial
directions.
Part 3 contains transitional and saving provisions, which
deal with Ministerial directions and security assessments issued under the
existing legislation, immediately before the commencement of the proposed
amendments.
Background
There has been parliamentary interest and consideration of
issues related to security of the telecommunications sector for a number of
years. The Bill reflects previous consideration of issues pertaining to the
security of the telecommunications sector generally by the PJCIS, as well as
more recent Government policy. In particular, the PJCIS, as constituted in the
43rd and 44th Parliaments, gave bipartisan support to the development of TSSR
measures, including in-principle support for the core elements of a regulatory
framework. The Government supported the PJCIS’s recommendations and now proposes
to implement them in this Bill.
2013 PJCIS report
In 2013, as part of its report examining potential reforms
to the Australia’s national security legislation,[5]
the PJCIS recommended that ‘the Government amend the Telecommunications Act
1997 to create a telecommunications security framework’ with the following
features:
- a telecommunications industry-wide obligation to protect
infrastructure and the information held on it or passing across it from
unauthorised interference a requirement for industry to provide the Government
with information to assist in the assessment of national security risks to
telecommunications infrastructure and
- powers of direction
and a penalty regime to encourage compliance.[6]
The PJCIS also recommended that (through a Regulation
Impact Statement (RIS)) the Government also consider:
- the interaction of
any such proposed regime with existing legal obligations imposed upon
corporations
- the compatibility of
the proposed regime with existing corporate governance where a provider’s
activities might be driven by decisions made outside of Australia
- consideration of an
indemnity to civil action for service providers who have acted in good faith
under the requirements of the proposed framework and
- the impacts of the
any such proposed regime on competition in the market-place, including:
- the potential for proposed requirements to create a
barrier to entry for lower cost providers
- the possible elimination of existing lower cost
providers from the market, resulting in decreased market competition on pricing
- any other relevant effects.[7]
The Government released a response to parts of the 2013
PJCIS report in July 2015, supporting this recommendation and indicating its
intention to introduce legislation within the year, following public
consultation on an exposure draft Bill. The Government further indicated its
intention to refer the Bill, once introduced, and a RIS to the PJCIS for
inquiry and report.[8]
The measures proposed by the Bill are broadly consistent with the above recommendations
and the Government’s response. The Government released two exposure draft (ED)
Bills for public consultation in June and November 2015.[9]
The second Exposure Draft made a ‘number of changes to improve the operation of
the proposed legislation in response to feedback received ...’[10]
It also issued an unclassified RIS (with some redactions of classified
information) in July 2015.[11]
The finalised RIS is annexed to the Explanatory Memorandum to the Bill and addresses
the key considerations noted above and analyses the respective net regulatory
benefits of the policy options.[12]
2015 PJCIS report
In its advisory report on the Telecommunications
(Interception and Access) Amendment (Data Retention) Bill 2014 (examined in Bills Digest No. 89, 2014–15) the
PJCIS also recommended that ‘the Government enact the proposed
telecommunications sector security reforms prior to the end of the
implementation phase for the Telecommunications (Interception and Access)
Amendment (Data Retention) Bill 2014’.[13]
Following passage of the latter Bill in March 2015, the 18-month implementation
phase for the data retention regime commenced on 13 October 2015 and ended on
13 April 2017.[14]
The PJCIS noted several potential security risks associated
with the (then) proposed mandatory data retention scheme, including the
potential for increased unlawful access to, or compromise of, personal
information that may be required to be retained under the scheme. It considered
that the timely implementation of TSSR measures was critical to the integrity of,
and community confidence in, the data retention regime (particularly as the
data retention regime was non-prescriptive as to where retained data must be
stored, and therefore allowed its storage at offshore facilities). The PJCIS
stated it was ‘strongly of the view’ that the TSSR measures it considered in
its 2013 report ‘should be finalised and implemented prior to the end of the
[data retention] implementation period’.[15]
The PJCIS also indicated its preference for any future TSSR-related legislation
to be referred to it for inquiry and advisory report to the Parliament.[16]
The Government supported the PJCIS’s recommendation,
stating that it would ‘introduce a [TSSR] scheme prior to the conclusion of the
data retention implementation period’.[17]
The introduction of the Bill in November 2016 gives effect to that response.
That said, there is likely to be a period of time in which
the data retention regime (DDR) will be fully operational in the absence of a dedicated
regulatory framework for TSSR (given the commencement date specified in the
Bill (12 months after royal assent) and the likely timing for the debate in
Parliament and potential passage of the Bill. This delay means that the Government
will arguably have a reduced capacity during the 12-month period before the
TSSR scheme commences to inform itself about storage arrangements for data that
is retained, and take steps to ensure its security (particularly in relation to
offshore storage arrangements). The AGD explained that during the
implementation period for DRR that (at that time) it did not have visibility of
the nature and extent of offshoring arrangements, with Mrs Anne Sheehan (Assistant
Secretary, Communications Security Branch, National Security Division of the
AGD) stating:
We do not have a complete picture of every company's offshore
storage of data. In conversations with some industry members, we may have some
visibility, but not across the board. What this bill would introduce is a
notification requirement, and one of the kinds of changes that would have to be
notified is information that is being stored offshore.[18]
Much may therefore depend on informal cooperation during
this period. One risk is that when the TSSR scheme commences, the new
notification requirements might identify data storage practices adopted in
response to the DDR over the previous 12 months that are inconsistent with the
new security obligations. If this risk eventuated, the early period in which
the TSSR scheme is operational may need to focus on remedial actions and
possibly require ‘retrofitting’ (despite the stated policy intention that the
measures proposed in the Bill will not generally require carriers, CSPs or
intermediaries to engage in retrofitting[19]).
In this regard, arguably the delayed introduction (and consequently, passage
and commencement) of the legislation deprives security agencies of the maximum
possible opportunity to pro-actively ensure that national security
considerations are given appropriate weight in decision-making about the
storage of retained data, particularly decisions about offshoring, before those
decisions are made and implemented.
2016
Australian Cyber Security Strategy
The Government’s Australian Cyber Security Strategy,
launched in April 2016, referred to ongoing work in developing the TSSR
initiatives in the course of implementing the PJCIS’s recommendations to
develop a regulatory framework:
Recognising the particular importance of secure
telecommunications networks, the Government is working with telecommunications
companies to manage supply chain risks by providing advice on protecting their
networks and the information stored and carried across them. This includes
work the Government is doing on Telecommunications Sector Security Reform to establish
more formal and comprehensive arrangements to better manage national security
risks of espionage, sabotage and interference.[20]
(emphasis added)
Committee
consideration
Parliamentary
Joint Committee on Intelligence and Security
The Bill was referred to the PJCIS for inquiry and report
by April 2017. Details of the inquiry are at Review
of the Telecommunications and Other Legislation Amendment Bill 2016. The
Committee reported on 30 June 2017 and made 12 recommendations for the
Government to consider prior to the passage of the Bill. The Committee was
unanimously satisfied that the legislative framework approach proposed in the
Bill is the most appropriate mechanism to ensure the security of Australia’s
telecommunications infrastructure.[21]
The recommendations can be summarised as:
- the
revision and expansion of the administrative guidelines (recommendations 1 and
4)
- the
exemption of broadcasters from the obligations set out in the Bill
(recommendation 2)
- ensuring
effective and regular information sharing (recommendation 3)
- allowing requests for exemptions by carriers and carriage service
providers for certain changes (recommendation 5)
- clarifying
that the Bill does not affect the operation of privacy obligations
(recommendation 6)
- expanding
the annual reporting and review requirements (recommendations 7, 10 and 12)
- clarifying
responsibilities of the Communications Access Co-ordinator (recommendations 8
and 9).
Senate
Standing Committee for the Selection of Bills
The Senate Standing Committee for the Selection
of Bills recommended that the Bill not be referred to Committee.[22]
Senate
Standing Committee for the Scrutiny of Bills
The Senate Standing Committee for the Scrutiny of
Bills had no comment on the Bill.[23]
Policy
position of non-government parties/independents
Opposition
TSSR reforms were initially an ALP proposal. In May 2012,
the then Attorney-General Nicola Roxon, referred potential TSSR measures to the
PJCIS for inquiry during the 43rd Parliament and in particular, sought the
PJCIS’s views on whether a regulatory response was necessary or appropriate
and, if so, the appropriate structure of the regulatory model. As part of this
process, the then ALP Government issued a discussion paper.[24]
Bipartisan support for the development of TSSR measures and
the core features of the regulatory model continued. For example, in the PJCIS’s
2013 Report of the Inquiry into Potential Reforms of Australia’s National
Security Legislation (2013 PJCIS Report), the PJCIS unanimously recommended
that a TSSR framework be created ‘whether or not Government chooses to
introduce a data retention regime’ and that ‘there cannot be an effective and
equitable security regime without enforcement mechanisms’.[25]
Likewise the PJCIS, in its Advisory report on the
Telecommunications (Interception and Access) Amendment (Data Retention) Bill
2014 (2015 PJCIS Report), unanimously recommended:
... the Government enact the proposed Telecommunications Sector
Security Reforms prior to the end of the implementation phase for the
Telecommunications (Interception and Access) Amendment (Data Retention) Bill
2014.[26]
In addition, ALP Senators noted in the Senate Legal and
Constitutional Affairs References Committee’s 2015 Report on the Comprehensive
revision of the Telecommunications (Interception and Access) Act 1979 (2015
L&CA Report) that ‘Labor will continue to press for improvements to data
security through the Telecommunications Sector Security Reform (TSSR) process’.[27]
The Opposition does not appear to have commented publicly
about its position on the specific provisions of the Bill as introduced. However,
in 2015 the
Opposition criticised the first exposure draft of the Bill in light of
industry concerns, and called upon the Government to develop and refer a
revised exposure draft to the PJCIS for inquiry before introducing a Bill to
Parliament.[28]
Other
non-government parties and independents
As of the time writing, the position of independents and
cross-bench parties was unknown.
However, in 2015 the Australian Greens reportedly expressed
some general reservations (in the context of the first Exposure Draft of the Bill),
and in particular about proposed the new directions power now contained in proposed
section 315B. The Greens noted the potential for directions to be overly
prescriptive, effectively telling ‘telecommunications companies how to run
their networks and their data centres’.[29]
Despite this, the Greens do not appear to have announced a position on the current
Bill.
Position of
major interest groups
Previous
consideration of TSSR and position of interest groups
As noted above, TSSR has been considered by a number of
previous Parliamentary and departmental inquiries, with key issues raised by
stakeholder having been considered on previous occasions. For example, the 2013
PJCIS’s Inquiry into Potential Reforms of Australia’s National Security
Legislation (2013 PJCIS Inquiry) considered whether there was a case for
regulatory intervention in relation to TSSR, and, if there was, the appropriate
regulatory model. After considering industry submissions, the PJCIS did not
support stakeholder suggestions for voluntary or co-regulatory models.[30]
More recently, a large number of interest groups made
submissions to the AGD as part of the consultation process regarding the two EDs
of the Bill released in June and November 2015.[31]
Telecommunications companies and industry associations raised similar issues,
which resulted the Government making a number of amendments to the first Exposure
Draft Bill.[32]
Briefly these included:
- narrowing
the scope of the security obligation
- increasing
the threshold for the exercise of the directions powers
- the
inclusion of additional safeguards around the exercise of the directions powers
-
the inclusion of additional safeguards to protect the
confidentiality of commercially sensitive information obtained through the
exercise of the information gathering power
- providing
that directions issued by the Attorney-General will now be reviewable under the ADJR Act
- streamlining
and clarifying the operation of the notification obligation
- increasing
the implementation timeframe from six months to 12 months from Royal Assent
- narrowing the scope of the obligation to protect networks or
facilities to networks or facilities owned, operated or used by a carrier or
CSP.
- extending the response time imposed on the CAC in relation to notifications
to 30 days and capability plans to 60 days (unless further information relating
to a notification has been requested)
-
increasing timeframes for affected parties to provide a
submission after a written notice of direction from 14 to 28 days
- providing that companies will now be able to provide copies of
documents, and also be entitled to reasonable compensation for complying with a
requirement to provide a copy of a document under the information gathering
powers
- providing that the Secretary of the AGD is required to have
regard to the likely cost to comply with an information gathering request
before issuing that request and
-
expanding the confidentiality requirements to protect the
confidentiality of commercially sensitive information or documents provided in
individual notifications or security capability plans.[33]
Current
position of major interest groups
The issues raised by major interest groups in submissions
to the Exposure Draft consultation process (to the extent they relate to provisions
that are consistent between the Bill and ED) as well as those made to the PJCIS’s
inquiry into the Bill are examined under the heading ‘Key issues and provisions’. However, briefly those issues included:
- the
appropriateness of key definitions
- the
appropriateness and breadth of application of the security obligation
- compliance
with the notification obligation
- the
threshold that must be satisfied and matters to be considered before a
direction can be given by the Attorney-General and
- application
of the regime to ‘over-the-top’ (OTT) services such as web-based email, voice
over internet protocol (VoIP) and cloud computing services.
Joint
submission from industry associations
The Australian Industry Group (AiGroup), Australian
Information Industry Association (AIIA), Australian Mobile Telecommunications
Association (AMTA) and Communications Alliance (the Associations) made a joint
submission to the PCJIS’s inquiry into the Bill.[34]
The Associations raised a number of concerns about the Bill, including its
underlying policy.
Incorrect
policy approach
The Associations stated in its submission to the PCJIS’s
inquiry into the Bill that the regime proposed by the Bill ‘appears to be
founded on the incorrect assumption that security risks are known ... before
service introduction or equipment deployment occurs’ and noted that in practice,
security threats ‘typically emerge, or become known, after
introduction/deployment’.[35]
More specifically, the Associations stated that the Exposure
Draft ‘fail to answer the fundamental question of what specific failings and/or
weaknesses Government is seeking to address’ and that it was:
... unclear how this additional layer of regulation and cost to
Industry and intrusion into the commercial decision making processes of C/CSPs
and carriage service intermediaries can be justified.[36]
In particular, the Associations expressed concern that the
proposed regime will grant to the Government ‘wide-ranging’ powers to intervene
in industry participants internal commercial decisions relating to:
- network
design
- M&A
activities and
- vendor selection, procurement and service supply options (including
resale of global or regionally based services and the use of global or
regionally based network or business resources of multinational organisations).[37]
The Associations also noted ‘there is no corresponding
obligation on Government to justify its actions, take responsibility for any
unintended outcomes’ or ‘bear the costs’ (a concern possibly partially ameliorated
by proposed subsections 315B(2) and (6), 315C(4) and (8)
and proposed section 315J, discussed below under ‘Key issues and provisions’).[38]
The Associations concluded that the proposed regime ‘runs the very serious risk
that it will not be adaptable or flexible enough to tackle the risks that will
emerge’ and that a traditional ‘‘command-and-control’ regulatory framework’
will not be ‘agile enough’ to respond to emerging security threats and ‘also
runs the risk of unnecessarily increasing costs and investment risks of the
telecommunications industry which will impact Australia’s digital capability’.[39]
Support for alternative policy approaches
The Associations outlined what they considered to be ‘more
collaborative approaches’ to dealing with security threats to
telecommunications infrastructure and services used or being ‘contemplated in
major international markets’ and suggested ‘the benefits of adopting a more
collaborative, less prescriptive and less onerous strategy be carefully
considered and examined in Australia’ before the Bill is passed.[40]
The Associations provided a summary of the current regimes of the US and UK, as
well as the proposed Canadian regime.
In summary, the Associations argue that industry-led (and
possibly voluntary) frameworks developed either independently of (or in
collaboration with) Government that reflect standards and practices from other
jurisdictions is a more effective, adaptable and cost-effective policy approach
than the regime proposed by the Bill.
However, in relation to the policy approaches adopted by
other countries the AGD noted in its submission to the Inquiry into the Bill:
International voluntary compliance frameworks, such as those
outlined in the joint submission of the Australian Industry Group, Australian
Information Industry Association, Australian Mobile Telecommunications
Association and Communications Alliance [The Associations], are often cyber
security focused and outline voluntary procedures for sharing cyber threat
information.[41]
The AGD went on to note that Australia already ‘has
voluntary information sharing forums in place which focus on cyber security
generally’ and that the proposed TSSR ‘extends beyond general cyber security to
enable the protection of Australia’s critical infrastructure from specific
national security risks’ and therefore the Bill seeks to formalise ‘the
existing and emerging relationships with the telecommunications industry’ with
a view to enabling government ‘to identify where security risks are and enable
engagement at the earliest possible time’.[42]
Inability of the Bill to deal with emerging technology
and innovation in the sector
The Associations argued that the regime proposed by the
Bill would slow down industry responsiveness and ability to innovate ‘and will
be more likely to stifle innovation necessary to keep pace with the increasing
sophistication of cyber threats’.[43]
This, it was argued, would be because telecommunications sector businesses
would ‘focus on minimising exposure to regulatory imposts or on compliance’
instead of on innovation ‘particularly in the context of the Internet of Things’.[44]
The Associations noted that ‘the Security Capability Plans
that the revised draft legislation has introduced, while being very useful in
many areas, would ‘not be able to overcome the problems that the proposed
reforms pose for flexible and fast innovation processes’.[45]
The Associations concluded ‘it appears even more evident
that the proposed reforms do not strike an appropriate balance between risk and
opportunity’ as the regime proposed by the Bill would unable to deal with
emerging technology and would stifle innovation.[46]
However, in response to this issue, the AGD noted that the
Bill ‘proposes a balanced and risk-based approach to take into account the
needs of the Australian telecommunications sector to remain competitive and innovative
in the market, having regard to minimising regulatory impacts’.[47]
Australian
Centre for Cyber Security
The Australian Centre for Cyber Security (ACCS) was the
only published submission to note the potential overlap between the regime
proposed by the Bill and the data retention regime created by the Telecommunications
(Interception and Access) Amendment (Data Retention) Act 2015 (the Metadata
Act).
The ACCS noted that under the Bill the AGD will have the
power to collect any type of information from a carrier or CSP and:
- this
power is only overseen by an annual report submitted by the AGD to Parliament
- this
power may be delegated to the Director-General of the ASIO and
- ASIO
may in turn share the information gathered with the AFP and third parties.[48]
The ACCS noted that from a technical perspective, metadata
includes IP (Internet Protocol) source and destination addresses, source and
destination port addresses and protocol numbers and ‘therefore includes
URLs/web browsing history’.[49]
The ACCS referred to this set of session metadata as ‘5-tuple’ and noted that
‘the 5-tuple falls within the pool of ‘any information’ the AGS and ASIO may collect
from’ carries and CSPs under the Bill.[50]
The ACCS noted that ‘using metadata to detect and resolve
cyber security threats quicker and in near real-time is a developing trend’ and
that as a result, a carrier or CSP ‘may therefore retain more metadata, and for
longer, than it usually would’ as not collecting, retaining and analysing the
5-tuple session metadata ‘from most devices connected to the Internet’ may
result in a carrier or CSP not ‘doing your best and exercising competent
supervision’, which is what the Bill requires.[51]
The Bill
and the Metadata Act
The ACCS noted that as the regime proposed by the Bill and
the Metadata Act both address the issues related to national security,
there is therefore effectively duplication of the ‘metadata creation, retention
and disclosure’ obligations imposed on carriers and CSPs.
The ACCS noted that whilst the Metadata Act regime
does not apply to the ‘3-tuple’ (destination IP, destination port and protocol
number), the regime proposed by the Bill will. The ACCS stated that whilst 3-tuple
metadata ‘is not required to be retained and is not being disclosed by the TelCo
to the agencies’ under the Metadata Act, under the regime proposed by
the Bill ‘the 3-tuple may potentially be required to be disclosed to the AGD and
the agencies’.[52]
The ACCS noted that both the Metadata Act regime
and that proposed by the Bill ‘essentially address the same metadata but with
different procedures’ and that as a result of those differences ‘oversight,
governance and ethical risks’ may arise.[53]
Further, the ACCS noted that whilst the Metadata Act regime oversight
powers have been introduced:
There are no clear public guidelines and oversight mechanisms
regarding the collection and sharing of the 5-tuple information between the
AGS, ASIO, the AFP and third parties.[54]
The ACCS again noted that the metadata dealt with ‘is more
information than what is addressed under’ the Metadata Act and that as
result of the lack of ‘clear boundaries’ regarding ‘how overlaps are to be
addressed between collecting the information for the purposes of national
security’ under the regime proposed by the Bill and that collected under the Metadata
Act regime ‘may lead to forum-shopping by the agencies’ between the Bill’s
regime and the Metadata Act regime.[55]
The ACCS noted that as ‘it makes little sense not to
simultaneously retain destination information under a ‘situational awareness’
and ‘threat intelligence’ strategy’, compliance with the Bill’s regime may
result in carriers and CSPs collecting, retaining and analysing the 5-tuple
(which includes source and destination metadata) in order to identify emergent
threats, incidents and attacks.[56]
In turn, the AGD could then require carriers and CSPs to provide that 5-tuple
metadata (including the 3-tuple metadata), and in turn share it with ASIO, the
AFP and other third parties, despite the contrary intention and requirements
under the Metadata Act regime in relation to the 3-tuple and that this
represented ‘potentially conflicting positions between the law and policy and
the two regimes’.[57]
The ACCS concluded:
Overall, the metadata under both regimes are just the same
metadata at the end of the day. The same metadata is accessed for the same
purposes: law enforcement and national security. However, the oversight
mechanisms regarding access for security under the two regimes differ vastly. The
purpose for this difference in treatment is not made clear. Metadata under the
TSSR, which is the vast majority of session metadata and may have greater
privacy implications, require no authorisation and notification process, and
little independent oversight, unlike the source IP and port addresses under the
Metadata Creation, Retention and Disclosure Regime.[58]
The ACCS also noted that the Commonwealth Ombudsman ‘is
not granted oversight powers’ over the AFP and metadata collected under the
Bill’s regime (unlike with metadata collected under Metadata Act) and
therefore recommended the alignment of the Bill’s regime with that of the Metadata
Act ‘so as to avoid fragmentation in terms of data types, retention
requirements, disclosure rules and oversight’.[59]
Financial
implications
The Explanatory Memorandum notes that cost of resourcing
and administering the scheme proposed by the Bill by ASIO and AGD is estimated at
$1.6m annually ‘due to increased engagement with C/CSPs and to review
notifications of proposed changes to telecommunications systems and services’.[60]
The Explanatory Memorandum estimated the total cost to
industry of the TSSR regime proposed by the Bill at approximately $220,000 per
C/CSP per year and noted that such costs ‘would represent a modest additional
cost to the sector which has revenue in excess of $43b a year’.[61]
Statement of Compatibility with Human Rights
As required under Part 3 of the Human Rights
(Parliamentary Scrutiny) Act 2011 (Cth), the Government has assessed the
Bill’s compatibility with the human rights and freedoms recognised or declared
in the international instruments listed in section 3 of that Act. The
Government considers that the Bill is compatible.[62]
Parliamentary
Joint Committee on Human Rights
On 22 November 2016, the Parliamentary Joint Committee on
Human Rights reported that the Bill did not raise human rights concerns.[63]
Key issues and provisions
As table item 2 of proposed section 2
provides that the TSSR will commence 12 months after the Act receives Royal
Assent, the TSSR will have a delayed commencement in line with feedback from
industry.
Administrative
guidelines
To aid the transition to the TSSR, the AGD will develop, in
consultation with industry, non-binding administrative guidelines that will
provide carriers and CSPs with guidance about:
- which parts of networks and facilities are particularly
vulnerable to unauthorised access and interference and how they can maintain
competent supervision and effective control over their networks
- what is required to meet their legislative requirements,
including what is expected of carriers and CSPs to comply with the security
obligation (including possible control measures and mitigations) and
-
when a carrier or NCSP should notify of proposed changes
(including what should and should not be notified and included or not included
in a SCP).[64]
The AGD published draft
administrative guidelines in November 2015.[65]
The PJCIS Advisory report recommended that the administrative guidelines be
revised to provide ‘comprehensive information, clarity and certainty to
industry in a greater range of circumstances’, prior to the conclusion of the
12 month implementation period.[66]
Over-the-top
services
The uncertainty regarding the potential application of the
proposed regime to ‘over the top-services’ was an issue raised by a number of
stakeholders. ‘Over the top’ (OTT) service providers are services ‘such as such
as web-based email, VoIP or [a] cloud service’.[67]
In relation to the application of the Bill’s provisions to OTT services, the Law
Council of Australia (LCA) noted that the regime proposed by the Bill ‘appears
to apply to Australian based’ carriers, CSPs and intermediaries ‘that supply
OTT services’ but will ‘not apply to international OTT services or
internationally based’ carriers or CSPs ‘that provide OTT services’ to
Australians.[68]
The LCA noted that ‘it is not apparent as to how the level of risk will be
calculated’ when determining whether Australian based carriers and CSPs
fulfilled the security obligations ‘when they supply OTT services’.[69]
The LCA recommended that ‘the security obligations should relate to any additional
likely level of security risk with the supply of OTT services when compared with
the level of risk that applies where the service is obtained directly from the
OTT service’.[70]
The Associations argued:
... the legislation continues to only apply to a subset of the
Australian telecommunications sector, i.e. C/CSPs and carriage service
intermediaries, but it does not apply to overseas OTT services. ... The
regulatory burden of the reform falls onto a subset of the global market place
for the supply of services, i.e. the burden only falls on Australian-based
C/CSPs, including intermediaries as defined in the Act. Overseas service
suppliers providing OTT services will not be subject to the TSSR. An Australian
based C/CSP simply reselling OTT services faces substantial regulatory
uncertainty and regulatory risk under the TSSR framework.[71]
The Associations recommended that carriers and CPSs should
only be required to ‘take action under the legislation’ if their supply of
relevant services (including OTT services) ‘adds substantive security risk’.[72]
Further, the Associations argue that the obligations of carries and CSPs should
be assessed solely on the basis of the:
- level
of security risk that applies if the service is obtained directly from the
service supplier
- level
of security risk that applies if the service is obtained via the carrier or CSP
and
- steps
can be implemented by the carrier or CSP to address ‘any added security
risk’.[73]
The Associations expressed their concern that the reforms
proposed by the Bill would relegate Australian-based telecommunications
businesses to ‘play minor, low-value roles in the supply of internet services’
and that the reforms would result in overseas companies dominating ‘the supply
of value-adding OTT services, resulting in a negative effect on competition,
the industry and the overall framework required to assist in achieving the TSSR
policy objective’.[74]
Whilst the Bill will not apply to international OTT
service providers or internationally based carriers or CSPs that provide OTT
services to Australians (due to the lack of a physical presence in Australia),
it will apply to Australian carriers and CSPs that provide or re-sell OTT
services.
In this regard the concerns noted above should be
considered within the context of the deliberately non-prescriptive approach
taken to the content of the security obligations (discussed below). Importantly
the security obligations ‘impose a subjective element which means that what is
required to comply with the obligation will differ’ according to the risk
profile and the specific activities of the relevant entity.[75]
The Explanatory Memorandum outlines how the risks of the security obligation is
aimed at can be assessed:
The following factors will contribute to whether a C/CSP is
more likely to be actively targeted and therefore have an increased risk from
espionage, sabotage or foreign interference:
- percentage of market share – the larger the customer base the
greater the aggregated data;
- sensitivity of customer base – some customers will have more
information of a sensitive nature being communicated and held on networks and facilities
than others – including government and critical service providers, science and
research organisations, large or significant commercial organisations, and
large healthcare provider organisations (or their suppliers and business
partners); and
- criticality of the network – for example, where the
telecommunications network or service supports the delivery of other critical
services, such as power, water, health, banking or where it provides services
to critical customers.[76]
Most OTT services would be considered at less risk of espionage,
sabotage or foreign interference than non-OTT services or facilities of the
types noted above. Further, the Explanatory Memorandum also noted:
Not all parts of networks and facilities are equally
vulnerable to national security risks. ... [The]areas of greater security
interest are:
- network operation centres, including infrastructure used to
facilitate support of the network;
- lawful interception equipment or operations;
- any part of a telecommunications network that manages or stores:
- aggregated information about customers
- aggregated authentication credentials of a significant number of
customers
- administrative (privileged user) authentication credentials for
the network or related systems
- any place in a telecommunications network where data belonging to
a customer or end user aggregates in large volumes, being either in transit or
stored data; and
- any additional area as advised in writing, in response to changes
in threat, technology and business practices.[77]
Therefore OTT services would be considered at less risk of
intrusion and interference that the types of non-OTT services or facilities
noted above.
Finally, whilst there is no legislative prescription as to
what constitutes ‘best endeavours’, ‘competent supervision’ or ‘effective
control’ in relation to OTT services provided by carriers or CPSs, the
Explanatory Memorandum notes:
The Bill does not prescribe what technical solutions a C/CSP
should use to secure networks to protect information or the integrity and
availability of the network, as this will be highly dependent on factors
specific to each network and business delivery model.[78]
However, it does note that carries and CSPs will be
expected to ‘demonstrate effective control and competent supervision over the
networks and facilities’ that they own or operate, and this would include implementing
measures that address ‘vulnerabilities that can arise through equipment supply,
outsourcing and offshoring arrangements’.[79]
Further, the Explanatory Memorandum provides guidance to the ‘competent
supervision’ aspect of the security obligations, stating it means:
... the ability of a C/CSP to maintain proficient oversight of
its networks and facilities and could include arrangements to maintain:
- visibility of network and facility operations;
- visibility of key data flows and locations;
- awareness of parties with access to network infrastructure; and
- the ability to detect security breaches or compromises.[80]
In relation to the ‘effective control’ aspect of the security
obligations, the Explanatory Memorandum states that this:
... means the ability of the C/CSP to maintain direct authority
and/or contractual arrangements which ensure that networks, facilities,
infrastructure and information stored or transmitted within networks, is
protected from unauthorised interference. This would include authority over all
parties with access to network infrastructure and data. It could include the
ability to:
- direct actions to ensure the integrity of network operations and
the security of information carried on them;
- terminate contracts without penalty where there has been a
security breach or data breach reasonably attributable to the contracted
services or equipment;
- address issues of data sovereignty;
- direct contractors to carry out mitigation or remedial actions;
- oblige contractors to monitor and report breaches to the C/CSP;
and
- re-establish the integrity of data or systems where unauthorised
interference or unauthorised access has occurred (for example to confirm
accuracy of information or data holdings).[81]
This would appear to suggest that the security obligation
is an outcome-based one, and therefore provides Australian carriers and CSPs
that provide or re-sell OTT services a significant degree of flexibility
regarding how they meet their obligations. However, at the PJCIS’s hearing into
the Bill, a number of witnesses again raised concerns about how the risk posed
by OTT services would be evaluated (and therefore how carriers and CSPs could
meet their security obligation) and the supposed competitive disadvantage
Australian based OTT service providers would face by having to comply with the
security obligation.[82]
In relation to any residual concerns raised by
stakeholders about the ‘uncertain’ application of the TSSR to Australian-based
OTT services provided by carriers and CSPs, how risk is to be evaluated and the
security obligation discharged in relation to OTT services, members of the
Parliament might wish to consider requesting the Government develop targeted
administrative guidance to relevant Australian carriers and CSPs that provide OTT
services. This could be done, for example, by including some guidance in the
Administrative Guidelines supporting the scheme, a draft copy of which is
available on the AGD’s website.[83]
Security
obligations
The Government notes that because telecommunications
networks and facilities of carriers, CSPs, and carriage service intermediaries (intermediaries)
transfer and hold sensitive information and data they are ‘attractive targets
for espionage, sabotage and foreign interference activity by state and
non-state actors’.[84]
The national security risks that may arise from such espionage, sabotage and
foreign interference include:
- compromise or degradation of telecommunications networks
- compromise of valuable data or information of a sensitive nature,
such as aggregate stores of personal data or commercial or other sensitive data
-
impairment of the availability or integrity of telecommunications
networks or
- the potential impact on other critical infrastructure or
government services (such as banking/finance, health or transport services).[85]
Currently section 313 of the Act requires that carriers,
carriage service providers and carriage service intermediaries must ‘do their
best’ to prevent networks and facilities being used to commit offences and also
to provide ‘reasonable assistance’ to authorities for the purposes of enforcing
criminal and pecuniary laws, protecting public revenue and safeguarding
national security.
Proposed subsections 313(1A), (1B) and 313(2A)
are designed to complement the existing obligations imposed by the Act by
imposing a new security obligation on the telecommunications industry that the
Government argues is an appropriate response to manage ‘national security risks’
on a ‘cooperative basis rather than through the formal exercise of regulatory
powers’.[86]
In general terms the security obligation requires carriers,
CSPs and some intermediaries to (for the ‘purpose of security’) ‘do their best’
to protect telecommunications networks and facilities that they own, operate or
use from unauthorised interference, or unauthorised access. The term ‘security’
is defined by reference to the meaning of that term in section 4 of the Australian Security
Intelligence Organisation Act 1979 (ASIO Act). The term
‘security’ is defined in the ASIO Act to mean:
(a) the protection of, and of the people of, the Commonwealth
and the several States and Territories from:
(i) espionage;
(ii) sabotage;
(iii) politically motivated
violence;
(iv) promotion of communal
violence;
(v) attacks on Australia’s defence
system; or
(vi) acts of foreign interference;
whether directed from, or committed within, Australia or not;
and
(aa) the protection of Australia’s territorial and border
integrity from serious threats; and
(b) the carrying out of Australia’s responsibilities to any
foreign country in relation to a matter mentioned in any of the subparagraphs
of paragraph (a) or the matter mentioned in paragraph (aa).
The above definition is further expanded by connected
definitions contained in section 4 of the ASIO Act. For example, the acts
of foreign interference is defined as meaning activities relating to
Australia that are carried on by or on behalf of, are directed or subsidised by
or are undertaken in active collaboration with, a foreign power, being
activities:
- are
clandestine or deceptive and:
- are
carried on for intelligence purposes
- are
carried on for the purpose of affecting political or governmental processes or
- are
otherwise detrimental to the interests of Australia or
- involve
a threat to any person.
Likewise the term attacks on Australia’s defence
system is defined expansively as including:
... activities that are intended to, and are likely to,
obstruct, hinder or interfere with the performance by the Defence Force of its
functions or with the carrying out of other activities by or for the
Commonwealth for the purposes of the defence or safety of the Commonwealth.[87]
The term politically motivated violence, used
in paragraph (a)(ii) of the definition of security is defined as meaning:
- acts or threats of violence or unlawful harm that are intended or
likely to achieve a political objective, whether in Australia or elsewhere,
including acts or threats carried on for the purpose of influencing the policy
or acts of a government, whether in Australia or elsewhere or
- acts
which:
- involve
violence or are intended or are likely to involve or lead to violence (whether by the persons who carry on those acts or by other persons) and
- are
directed to overthrowing or destroying, or assisting in the overthrow or
destruction of, the government or the constitutional system of government of
the Commonwealth or of a State or Territory or
- acts
that are terrorism offences[88]
or
- acts that are offences punishable under Division 119 of the Criminal
Code Act 1995, the Crimes (Hostages) Act 1989 or Division 1 of Part
2, or Part 3, of the Crimes (Ships and Fixed Platforms) Act 1992 or
under Division 1 or 4 of Part 2 of the Crimes (Aviation) Act 1991[89]
or
- acts
which:
- are
offences punishable under the Crimes (Internationally Protected Persons) Act
1976,[90]or
- threaten
or endanger any person or class of persons specified by the Minister for the
purposes of this subparagraph by notice in writing given to the Director
General.
Finally, promotion of communal violence,
used in paragraph (a)(iv) of the definition of security is defined as ‘activities
that are directed to promoting violence between different groups of persons in
the Australian community so as to endanger the peace, order or good government
of the Commonwealth.’
Whilst the notes in proposed subsections 313(1A)
and (2A) provides a summary of the definition of security that the
Explanatory Memorandum states is intended to highlight the most important
aspects of the definition as it would apply to the TSSR scheme, those notes in
no way limit the broad meaning of the term ‘security’ for the purpose of the
new security obligations.[91]
The Explanatory Memorandum does not appear to explain the
need to apply all components of the definition of security in the ASIO Act
noted above, rather than specifically limiting it to the matters extracted in
the notes to proposed subsection 313(1A) and (2A). For example,
it is not clear why there is a need to impose the security obligation for the
purpose of the paragraph (b) of the definition of security (the carrying out of
Australia’s responsibilities to any foreign country in relation to a matter encompassed
by the definition of security). Arguably this could result in the proposed
security obligations being extended to cover other countries’ security
interests where Australia has responsibilities to that country (for example,
under a treaty or other agreement).
Concerns
about the use of the ASIO Act definition of security
One interest group expressed concern about the Bill using
the ASIO Act’s definition of ‘security’ in relation to the security
obligation, stating it would ‘have the serious consequences’ of:
- preventing
the use of network facilities or other infrastructure located offshore to supply
services
- creating
smaller scale, higher cost and delayed services using onshore infrastructure
and
- encouraging
customer migration to direct supply from offshore entities.[92]
However, most of the stakeholders concerns about the
security obligation are related to its breadth of application. This is discussed
below.
Key
definitions underpinning the security obligations
The security obligations are linked to existing
definitions in the Act. To give context to the discussion regarding the
security obligation, and concerns raised by stakeholders, these are briefly
examined below.
The security obligation applies to facilities and
telecommunications networks. Facility is defined in section 7 of
the Act as meaning:
(a) any part of the infrastructure of a telecommunications
network; or
(b) any line, equipment, apparatus, tower, mast, antenna,
tunnel, duct, hole, pit, pole or other structure or thing used, or for use, in
or in connection with a telecommunications network.
Telecommunications network is defined as ‘a system,
or series of systems, that carries, or is capable of carrying, communications
by means of guided and/or unguided electromagnetic energy.’ In turn, communications
is defined as ‘any communication’ including (but not limited to):
(a) whether between persons and persons, things and things or
persons and things; and
(b) whether in the form of speech, music or other sounds; and
(c) whether in the form of data; and
(d) whether in the form of text; and
(e) whether in the form of visual images (animated or
otherwise); and
(f) whether in the form of signals; and
(g) whether in any other form; and
(h) whether in any combination of forms.
In addition to the above, the Act regulates three types of
entities that the Bill proposes to regulate: carriers, carriage
service providers (CSPs), and carriage service intermediaries
(intermediaries). These entities are characterised as follows:
-
carriers own or operate telecommunications infrastructure or
otherwise elect to be a carrier, and must hold a carrier licence
- a CSPs is any entity that supplies, or proposes to supply, a listed
carriage service to the public (for example, telephone services) to the
public whether or not they own the telecommunications infrastructure and
-
in simple terms an intermediary is any entity that, for reward, arranges
for the supply of a listed carriage service by a CSP to a third
person, would be a CSP if the intermediary had supplied that carriage service,
or is in a contractual relationship with the third person for the continuing
supply of the carriage service. As such, intermediaries are entities such as resellers
and other entities that arrange the supply of a carriage service.[93]
A listed carriage service is any carriage
service for carrying communications by electromagnetic
energy between a point in Australia and one or more other points. The
definition requires a carriage service with one of the end points in Australia,
whether or not the other point is in or outside of Australia. A ‘point’
includes a mobile (or potentially mobile point), regardless of whether it is on
land, underground, in the atmosphere, in outer space, underwater, at sea or
anywhere else.[94]
Importantly, carriers, CSPs and intermediaries have a
degree of overlap. For example, an entity may be both a carrier and a CSP, and
therefore must obtain a carrier licence and also comply with the laws that
apply to carriers in addition to the laws that relevantly apply to CSPs (such
as those proposed by the Bill). Further, subsection 87(5) of the Act provides
that intermediaries are CSPs.[95]
As the above definitions are broad, they encompass a range
of infrastructure and devices ‘used, or for use, in or in connection with’ a
telecommunications network, and therefore the entities that own, operate or
control them.
The
security obligations generally
Proposed subsections 313(1A), (1B) and (2A) collectively
impose the security obligations on carriers, CSPs and intermediaries. Whilst
the obligations vary according to type of entity, generally the security
obligation requires carriers, CSPs or intermediaries to ‘for the purposes of
security ... do their best’ to protect certain telecommunications networks and
facilities from unauthorised interference or unauthorised access to ensure:
- the
confidentiality of communications and information carried or contained on the
network or facilities and
- the
availability and integrity of the network and facilities.[96]
The meaning of ‘do their best’ is discussed below under
the heading ‘Elements of the security obligation’.
The table below sets out the obligations that apply to
carriers and CSPs, those that apply to intermediaries and to which networks or
facilities those obligations relate. Proposed subsection 313(1A) sets
out the general security obligations listed above, which are owed by carriers
and CSPs in relation to any telecommunications networks or facilities that they
own, operate or use.
In contrast, the specific obligation imposed on carriers
and CSPs by proposed subsection 313(1B) provides that the general
obligation imposed on C/CSPs includes, but is not limited to, a requirement to
maintain competent supervision of, and effective control over, telecommunications
networks and facilities they own or operate. The obligation imposed on
intermediaries by proposed subsection 313(2A) applies to
telecommunications networks and facilities that they use to supply certain
services and does not depend upon ownership of, or the exercise of direct
control or supervision of, a network or facility.
Table 1: security obligations
Entity
|
Obligation
|
Networks or facilities it applies to
|
Possible consequences for breaches
|
Carriers and CSPs
|
Protect telecommunications networks and facilities from
unauthorised interference or unauthorised access to ensure:
- the
confidentiality of communications and information carried or contained on the
network or facilities and
- the
availability and integrity of the network and facilities[97]
|
Telecommunications networks and facilities they:
|
- Enforcement
action[99]
- Being
issued with a Direction[100]
- Possible
contravention of licence condition (and associated enforcement actions)[101]
|
Maintain competent supervision of and effective control over
telecommunications networks and facilities[102]
|
Telecommunications networks and facilities they:
|
Intermediaries
|
Protect telecommunications networks and facilities from
unauthorised interference or unauthorised access to ensure:
- the
confidentiality of communications and information carried or contained on the
network or facilities and
- the
availability and integrity of the network and facilities[104]
|
Telecommunications networks and facilities used to supply
a carriage service referred to in subsection 87(5) of the Act[105]
– essentially the infrastructure used by a person for the purpose of
arranging the supply of a carriage service to a third person for reward.[106]
|
Source: proposed subsections 313(1A), (1B) and (2A).
Immunity
from liability
Currently subsection 313(5) of the Act provides that a
carrier or CSP is not liable in relation to an act done or omitted in good
faith in the performance of the duties imposed by section 313, or in compliance
with a direction given by ACMA under section 312.
Items 10 and 11 would extend immunity from
liability to an act done or omitted in good faith in the performance of the
security obligations and in compliance with a direction issued under proposed
subsections 315A(1) or 315B(2).
Elements of the security
obligation
The security obligations contain a number of elements. Most
importantly these include:
- a
requirement to ‘do their best’ to prevent the relevant risk and
- a requirement to maintain ‘competent supervision’ of, and
‘effective control’ over telecommunications networks and facilities they own or
operate.
These are discussed below to give context to the concerns
about the security obligation.
Meaning of
‘do their best’ element of the security obligations
The security obligations contain a requirement that the
carrier, CSP or intermediary ‘do their best’ to fulfil the relevant obligation.
As noted earlier, the overarching design of the TSSR proposed by the Bill is
both outcome-based and deliberately non-prescriptive (in a technical sense). The
Bill’s security obligations are high-level obligations, the content of which
are to be determined on a case by case basis, with the aid of administrative
guidelines. The Explanatory Memorandum notes that the requirement ‘to do their
best imposes a subjective element which means that what is required to comply
with the obligation will differ according to the risk profile of the C/CSP’.[107]
The Explanatory Memorandum then notes that, as ‘the parts
considered more vulnerable are likely to change over time due to changes in the
way networks and services are operated and delivered’, administrative
guidelines ‘will outline what is expected of C/CSPs to comply with the security
obligation’.[108]
The Explanatory Memorandum notes that demonstrating ‘best
efforts’ to:
... secure networks would include as a minimum, ensuring
mechanisms for facilitating corporate awareness of the broad national security
vulnerabilities and risks posed to telecommunications networks and embedding
security considerations in to business decision-making and business delivery
models.[109]
The Explanatory Memorandum then notes that the security
obligation will be discharged where a carrier, CSP or intermediary can
demonstrate that it has ‘implemented effective security practices and measures’
to manage the relevant risks.[110]
When determining whether a carrier, CSP or intermediary
has ‘done their best’ to discharge the security obligation a court will
consider whether the actions or decisions taken (or not taken) are ‘reasonable
steps’, as discussed below.
‘Reasonable
steps’ aspect of the ‘do their best’ element of the security obligations
The Explanatory Memorandum notes that ‘do their best’ to fulfil
the security obligation ‘will depend on what steps are reasonable in particular
circumstances’.[111]
The Explanatory Memorandum provides an example of reasonable steps:
... an intermediary may be given access to services that may
provide them with information about security vulnerabilities. They would
therefore be expected to have appropriate procedural, governance and
contractual arrangements to secure this type of information so that this
knowledge of security vulnerabilities cannot be accessed by other parties and
exploited.[112]
(emphasis added)
In relation to carriers and CSPs:
... a C/CSP would need to take reasonable steps to ensure that
intrusions or breaches do not occur within networks or facilities that they
own, use or operate, and that the potential for malicious activity is
minimised, demonstrable by the security controls in place. This will be
particularly relevant where activity, left unchecked, could provide opportunity
to compromise the confidentiality, availability or integrity of
telecommunications infrastructure or information carried by, or across it.[113]
As such, it would appear that whether a carrier, CSP or
intermediary has done ‘their best’ by taking ‘reasonable steps’ to fulfil the
security obligations will be determined on a case by case basis, and will be
based on the information available to the entity at the time. Further, a
variety of factors such as the type and degree of risk, the cost of mitigating
the risk and so forth will be important in determining if the relevant
obligation was effectively discharged.
Competent
supervision and effective control
Proposed subsection 313(1B) provides that, as part
of the security obligations, carriers and CSPs are required to maintain
‘competent supervision’ of and ‘effective control’ over telecommunications
networks and facilities that they own or operate. Whilst not defined in the
Bill, the Explanatory Memorandum states that the ‘competent supervision’ means
the ability the of carrier or CSP ‘to maintain proficient oversight of its
networks and facilities’ and may include arrangements to maintain:
- visibility of network and facility operations
- visibility of key data flows and locations
- awareness of parties with access to network infrastructure and
- the ability to detect security breaches or compromises.[114]
The Explanatory Memorandum outlines that ‘effective
control’ means the ability of a carrier or CSP to:
... maintain direct authority and/or contractual arrangements
which ensure that networks, facilities, infrastructure and information stored
or transmitted within networks, is protected from unauthorised interference.
This would include authority over all parties with access to network infrastructure
and data. [115]
The Explanatory Memorandum expanded on the above, stating
‘it could include’ the ability to:
direct actions to ensure the integrity of network operations
and the security of information carried on them
terminate contracts without penalty where there has been a
security breach or data breach reasonably attributable to the contracted
services or equipment
address issues of ‘data sovereignty’
direct contractors to carry out mitigation or remedial
actions
require contractors to monitor and report breaches to the
carrier or CSP, and
re-establish the integrity of data or systems where
unauthorised interference or unauthorised access has occurred (for example, to
confirm accuracy of information or data holdings).[116]
Whether a carrier or CSP has maintained ‘competent
supervision’ of and ‘effective control’ over telecommunications networks and
facilities that they own or operate (and therefore if they have discharged
their security obligations) will be considered on a case by case basis.
Further, a variety of factors such as the terms of relevant contacts,
thoroughness of arrangements regarding other parties’ access to network
infrastructure will be important in determining if the relevant obligation was
effectively discharged.
Practical
examples
Non-binding administrative guidelines will outline to carriers
and CPSs how to comply with the security obligation, and that this will be
based on whether they have a low, medium or high risk profile and the parts of
networks and facilities considered most vulnerable to national security risks.[117]
The Explanatory Memorandum then notes that ‘this advice
and guidance will assist C/CSP to implement a risk managed approach to meeting
the security obligation’.[118]
The AGD has produced draft
guidelines that specifically deal with how the security obligation is to be
discharged.[119]
Under the heading ‘What do you need to do to meet your security obligation?’
the AGD state that the security obligation ‘is not absolute and is underpinned
by a 'reasonableness' test’.[120]
In summary, the AGD notes that to meet the security
obligations a carrier or CSP:
[is] expected to adopt ‘a risk-managed approach to managing
risks of espionage, sabotage and foreign interference to their networks and
facilities’
[has] a risk management culture and ‘processes and structures
that underpin the effective management of potential opportunities and adverse
effects’ that is based on a ‘structured approach to identifying, assessing and
controlling risks that emerges during a program or project life cycle’ such as
AS/NZS ISO 31000:2009 Risk management – Principles and guidelines which
is ‘the key standard for risk management’
focuses on risks posed by arrangements with suppliers (in
particular managed service providers) and particular service delivery models
(that is, outsourcing/offshoring)
demonstrates that it has processes, controls and arrangements
in place to manage ‘who’ can access systems, networks and communications (that
is, has competent supervision and effective control of its network)
use third-party assurance where appropriate
ensuring that authorised users have access to information,
communications and telecommunications networks and facilities when required
ensure the accuracy and completeness of information and
communications, as well as the protection of telecommunications networks and
facilities from compromise or unauthorised modification and
implementing robust access controls to limit who has access
to confidential communications and information, including information both in
transit and in storage and potentially using encryption as a key method of
ensuring confidentiality of information and communications.[121]
Security obligations and their application
The Exposure Draft applied the security obligations to
carriers, intermediaries and CSPs to ‘telecommunications networks and
facilities’ generally. A number of stakeholders expressed concern about the
breadth of the security obligations in the Exposure Draft Bill, including their
application to intermediaries:
It would not be reasonable for a duty to be imposed with
regards to the supervision and control of any other infrastructure than that
which the provider owns and controls – ‘their’ networks and facilities.[122]
The Bill appears to have responded to those concerns. The
security obligation now only applies to telecommunications networks and facilities
that are ‘owned, operated or used’ by the carrier or CSP.[123]
In relation to intermediaries, instead of the security obligations applying to
‘telecommunications networks and facilities’ generally, it is now restricted to
‘telecommunications networks and facilities used to supply the carriage service’
offered by the intermediary.[124]
However, despite these changes the Associations expressed
concern that the security obligation will apply to the telecommunications
networks and facilities used by carriers, CSPs and intermediaries,
arguing that ‘it is unclear what ‘use’ may actually entail and, maybe more
importantly, what would be required of C/CSPs/intermediaries to protect
networks that they are merely using’.[125]
The definition of ‘facility’ and the security obligations
A number of interest groups expressed concern about the
definition of ‘facility’ in the Act and the range of facilities to which the
security obligations would therefore apply.
The Associations argue that the definition of ‘facilities’
in the Act and used in the Bill is ‘vague and open to discretionary
interpretation’.[126]
The Associations contend that the proposed obligation to protect networks and
facilities from unauthorised interference and unauthorised access and to
maintain competent supervision and effective control of them is likewise ‘vague
and open to discretionary interpretation’ and therefore it is:
... conceivable that the term ‘facility’ could be interpreted
to encompass cloud computing and cloud storage solutions implemented by C/CSPs
as any supporting equipment would appear to meet the above definition. This has
the potential to significantly broaden the regulatory burden that C/CSPs face
under the regime and will leave them at a competitive disadvantage compared
with suppliers of equivalent services that are not C/CSPs.[127]
The Associations noted that ‘ex-post interpretation of
undefined (and even defined) terms in the technical areas of communications
create confusion at best and randomness at worst’ and should therefore be avoided.[128]
The LCA expressed similar concerns and noted that the
definition of ‘facility’ appears ‘to capture cloud computing and cloud storage
options implemented’ by carriers and CSPs and that it was unclear how carriers
and CSPs ‘will be able to effectively maintain their security obligations in
this context’.[129]
The LCA recommended that ‘the Attorney-General's Department consult with
industry’ on an adequate definition of ‘facility’ for the purposes of the
regime proposed by the Bill’.[130]
Optus noted similar concerns and in particular that the
practical effect of the definition of ‘facility’ would the application of the
security obligations to ‘infrastructure that would not normally be expected to
be relevant’ to the security obligations such as ‘content serving platforms for
streaming television or streaming content services’.[131]
Optus recommended that refining the definition of ‘facility’ would ‘prevent
overreach’ of the security obligations.[132]
Foxtel also expressed similar concerns noting that as the Act’s
definitions of ‘telecommunications network’, ‘communications’ and ‘carriage
service’ are not limited or described in any way by reference to the supply of
telephony or internet access services’ those terms could be interpreted as
applying to ‘infrastructure and facilities used to supply broadcasting and
content services (even where this is the sole or principal use of the
infrastructure or facilities)’.[133]
Foxtel then noted that it remained ‘concerned that the scope
of the proposed reforms is broad and unclear in relation to their application
to infrastructure and facilities used to supply broadcasting and content
services’.[134]
Foxtel argued that because broadcasting and content
services do not carry sensitive corporate or government information or
sensitive, confidential information about law enforcement activities, protected
information or potentially disclose the location of politicians or other
protected persons and they are not essential to the delivery and support of
critical services, such as, power, water and health, they should be excluded
from the security and notification obligations.[135]
Foxtel recommended that proposed subsection 313(1A)
and (2A) be amended to ‘clarify that infrastructure and facilities used
solely or principally for broadcasting or content services are not intended to
be subject to this additional regulation’.[136]
Foxtel argued that such amendments would ‘provide certainty in relation to the
application of the regulatory framework in future’.[137]
In relation to these concerns, the AGD noted that whilst the Bill ‘applies to
the protection of telecommunications networks and facilities, irrespective of
the type of service being provided over the networks’ it also enables
exemptions from the notification requirements to be provided to carriers and
CSPs ‘that offer a range of services’ including ‘in relation to broadcasting or
a subscription television service’.[138]
The AGD further noted whilst ‘the exemption process will be refined during the
implementation phase, in consultation with industry’, nonetheless:
... the provider would still be required to notify of changes
to other parts of their business that apply to the provision of other services,
such as telephony and broadband access.[139]
The PJCIS Advisory Report has recommended that the Bill
clarify that in circumstances where a broadcaster is exempt from being treated
as a carriage service providers under the Telecommunications Act 1997, they
are also not intended to be subject to the obligations set out in the Bill.[140]
Concerns about retrofitting
Some stakeholders raised concerns that compliance with the
security obligation would require expensive retrofitting of existing
facilities, systems and networks.[141]
For example, the Associations argued that the security obligation will apply ‘without
further distinction of the age of the systems, networks and facilities (jointly
systems) or whether systems are already existing and in place vs. newly
installed systems.’[142]
The Associations indicated that ‘industry could face very
high costs to rebuild existing networks’ if required to ‘retrofit or remove
existing facilities’[143]
and therefore recommended:
- ‘the
legislation itself ought to be amended to reflect the intention to not require
retrofits except in rare and extremely serious circumstances’ or
- ‘the
legislation should include a sunset clause on the ability to issue a direction
for a network retrofit’ and limit the ability of the government to require
retrofitting to ‘12 months after the expiry of the implementation period (i.e.
two years after the date of Royal Assent)’ which the Association argued ‘would
provide at least some element of certainty for C/CSPs as to the longevity of
existing systems’.[144]
Despite these concerns, it would appear unlikely that
carriers or CPSs will be required to conduct extensive retrofitting to comply
with the security obligations. The Explanatory Memorandum notes:
C/CSPs are not expected to retrofit all systems on
commencement of this security obligation. However, there may be very rare cases
where a significant security vulnerability is found in an existing system that
could facilitate acts of espionage, sabotage and foreign interference. In such
cases, government agencies will seek to work with the provider to develop cost
effective solutions to better manage the risks posed by the existing
vulnerability. Subject to how serious the security risk is and how willing the
C/CSP is to collaborate with government to manage the risk, the
Attorney-General could issue a direction requiring mitigation measures to be
implemented.[145]
Notification regime—overview
The CAC liaises between security and law enforcement
agencies and the telecommunications industry, and is committed to supporting
industry in understanding its interception capability obligations.[146]
Currently section 202B of the TIA Act requires carriers and NCSPs to
notify the CAC within the AGD of planned changes to telecommunications systems
and services which are likely to have a material adverse effect on the ability
of the carrier or NCSP to meet its obligations:
- under
the TIA Act (for example, retaining telecommunications data (‘metadata’)
under section 187A)
- under section 313 of the Act (that is, preventing networks and
facilities being used to commit offences and also providing reasonable
assistance to authorities for the purposes of enforcing criminal and pecuniary
laws, protecting public revenue and safeguarding national security).
Proposed section 314A is modelled on section 202B
and will require carriers and NCSPs to notify the CAC of individual proposed
changes to networks and services which could have a material adverse effect on
its ability to comply with the proposed security obligations. The CAC will have
the power to exempt carriers and NCSPs from the notification requirement in
full or part.[147]
Proposed section 314C will also provide carriers
and NCSPs with the option of submitting an annual SCP that forecasts multiple
proposed changes to their systems and services (in lieu of making multiple
individual notifications) that sets out how it proposes to meet the security
obligation in light of those proposed changes.
Individual notifications
Proposed subsections 314A(1) and (3) provide
that carriers and NCSPs are to notify the CAC in writing of its intention to
implement proposed individual changes to networks and services if that change
‘is likely to have a material adverse effect’ in its ability to comply with the
security obligations in proposed subsections 313(1A) and (2A).
Types of changes to be notified
Proposed subsection 314A(2) provides a
non-exhaustive list of the types of changes to a telecommunications system or
service that must be notified by the carrier or NCSP:
- providing
one or more new telecommunication services
- changing
the location of notifiable equipment (including moving equipment outside
Australia)
- procuring notifiable equipment (including procuring equipment that is located
outside Australia)
- entering
into outsourcing arrangements:
- to
have all or part of the telecommunication services provided or managed for the carrier or NCSP
-
to
have all or some information to which section 276 of the Act applies managed
for the carrier or NCSP (for example, information or documents that relate to the
contents or substance of a communication that has been carried by a carrier or‘metadata’)) or
- to
have all or some information to which section 276 applies (for example,
metadata) accessed by persons outside Australia.[148]
The Explanatory Memorandum provides further guidance about
the types of matters in relation to which carriers and NCSPs would be expected
to notify the CAC about. In particular the Explanatory Memorandum notes that carriers
and NCSPs would be expected ‘to notify the CAC when they are planning changes
to these more sensitive or vulnerable parts of networks’ and that the
administrative guidelines would ‘outline what is expected of C/CSPs to comply
with the notification obligation’.[149]
When
notification should occur
The draft guidelines also outline that it is in the
C/CSP's best interests to notify as early as possible, such as early in the
stages of considering a C/NCSP finalising any business plans, contracts or
negotiations and before entering into any binding undertakings.[150]
More specifically, the draft guidelines suggest that the
obligation should be discharged:
- in relation to procurement or acquisition: before taking any
steps as part of the decision-making approach (such as before issuing a request
for quote, tender or otherwise approaching the market) to allow security
considerations to be built into the proposal from the start and
- in relation to offshoring plans: before any plans are finalised
(and as early as possible) to allow the carrier or CSP to receive advice from
ASIO and the CAC regarding the process and thereby prevent inadvertently
exposing the networks to an increased risk of espionage, sabotage and foreign
interference activities.[151]
Notification
obligation only triggered where a proposed change is likely to have a ‘material
adverse effect’
However, the notification obligation is only triggered
where:
- a proposed change is likely to have a ‘material adverse effect’,
that is ‘an actual or measurable negative impact on the ability of the C/CSP’
to comply with security obligations to protect networks from risks of
unauthorised access and unauthorised interference and
-
the carriers or NCSPs ‘becomes aware’ that the implementation of
a proposed change is likely to have a material adverse effect on the capacity
of the carriers or NCSPs to protect telecommunications networks and facilities,
which recognises that ‘C/NCSPs are well-placed through their practices and
processes to identify risks associated with proposed changes’.[152]
The draft guidelines indicate that carriers and NCSPs will
be able to contact a hotline at AGD for advice as to whether a proposed change
constitutes a material adverse change.[153]
Exemptions from the
notification obligation
Proposed subsections 314A(4)-(7) allow the CAC to
provide (in writing) exemptions to a carrier or NCSP from the operation of proposed
section 314A generally or from the requirement to provide notifications in
relation types of changes specified in the notice of exemption.
The policy intent underlying the granting of exemptions
from the notification obligation is to allow non-critical or low-risk parts of
a carriers’ or CSPs’ business to be exempted, thus reducing the regulatory
burden imposed by the notification regime.
When determining whether to grant an exemption, the CAC
will seek advice from ASIO regarding security risk profile of a company which
in turn would be based on factors such as:
- the percentage of market share of the entity applying for the
exemption (the larger the customer base the greater the aggregated data)
- the sensitivity of the customer base (some customers will have
more information of a sensitive nature being communicated and held on networks
and facilities than others—including government and critical service providers,
science and research organisations, large or significant commercial
organisations, and large healthcare provider organisations (or their suppliers
and business partners) and
- the criticality of the network (for example, where the telecommunications
network or service supports the delivery of other critical services such as
power, water, health, banking or where it provides services to critical
customers).[154]
The Explanatory Memorandum notes that it is envisaged that
‘classes of providers may be exempt from the notification requirement on the
same grounds, for example, exemptions may relate to a particular type of low
risk service or network operator’ based on the factors such as those noted
above.[155]
However, the draft guidelines note that ‘there is no application process’ for carriers
or NCSPs wanting to be exempted from the notification obligation (in part or in
full’ and instead the ‘CAC will decide if and when to grant any exemption’
based on advice received from ASIO noted above.[156]
The PJICS Advisory Report recommended that the Bill be
amended to outline the application process for exemptions from notification
requirements, noting that the Attorney-General’s Department is ‘open’ to
amending the Bill to include an exemption application process.[157]
Annual Security Capability Plans
Proposed section 314C allows carriers and NCSPs to
submit an annual SCP to the CAC. Annual SCPs are a mechanism by which carriers
and NCSPs can notify the CAC of its intention to implement one or more proposed
changes to networks and services if those change ‘are likely to have a material
adverse effect’ its ability to comply with the security obligations.[158]
Further, SCPs will provide carriers and NCPSs with ‘an
opportunity to outline proposed changes within the context of the company’s
approach to security management’, and thereby ‘streamline the process of
assessing the security risks associated with each proposed change and
ultimately provide the CAC (and ASIO) with sufficient information to assess
whether proposed changes can be implemented without further engagement with
government agencies’.[159]
Types of changes that can be included in a SCP
Proposed subsection 314C(4) provides that the types
of changes to a telecommunications system or service that can be notified by
the carrier or NCSP to the CAC in an annual SCP includes (but is not limited
to) the types of changes listed in proposed subsection 314A(2) as well
as any types of changes specified by the CAC in a legislative instrument issued
under proposed subsection 314C(5). The draft guidelines noted:
... security capability plans should only include changes that
are likely to have a material adverse effect on the capacity of the C/NCSP to
comply with their obligation to protect their networks and facilities from unauthorised
access or interference under subsections 313(1A) and (2A).[160]
The use of SCPs to forecast changes
Whilst SCPs can be used to forecast and advise the CAC of
proposed future changes, the draft guidelines note that as a matter of
practicality there are limits to ‘how far in advance’ a SCP ‘should capture
proposed changes’ as (when the CAC’s maximum of 60 days to consider
notifications covered in a SCP is considered):
... it may not be feasible to include changes that have tight
deadlines for implementation and which require CAC consideration in a shorter
timeframe to avoid delaying a project.[161]
The draft guidelines further note that to ‘maximise the
benefit’ of submitting a SCP, it should, at a minimum ‘forecast proposed
changes to systems and services for the upcoming 12 months’.[162]
The draft guidelines also note that carriers or NCSPs that choose to submit as
SCP ‘are encouraged to notify proposed major changes such as development of a
new service or network as soon as possible’ but that the SCP should:
... include sufficient detail about each proposal to enable the
CAC and security agencies to adequately assess whether the proposed change is
likely to give rise to national security risks.[163]
Further, the major limiting factors on the length of time
that a SCP can be used to forecast proposed changes include the proposed
subsection 314C(8) which restricts carriers and NCSPs from submitting one
SCP per year, and prevents a previously submitted SCP from being updated during
that 12-month period.[164]
Other information that can be included in a SCP
Proposed subsections 314C(6) and (7) provide
that an annual SCP may also include the practices, policies and strategies adopted
by the carrier or NCSP to comply with the security obligations and any measures
or proposed measured to mitigate the risk of unauthorised interference or
access to telecommunications networks or facilities. The draft guidelines
provide the following examples of other types of information that can be
included in a SCP:
-
a description of the risk assessment processes used to identify
and manage security risks on networks, systems and services
-
arrangements and mechanisms in place for overseeing contracted
managed service provider compliance with security requirements and so forth
(for example standard contract terms concerning personnel, logical and physical
security requirements and access restriction and how compliance with these
terms is monitored and enforced) and
- any
assurance processes for vetting security practices of a vendor.[165]
The draft guidelines also note that a CSP can ‘detail any
current or proposed mitigation measures or controls to reduce the risk of
unauthorised access or interference’ and this this could ‘include access
controls in systems or oversight arrangements that are proposed to be built
into contracts with third parties’.[166]
The AGD notes that the inclusion of such additional information in a SCP:
... will help expedite the assessment of the security plan by
security agencies by reducing the likelihood that the CAC will need to request
additional information from a C/CSP about a proposed change.[167]
The Explanatory Memorandum also notes that where a carrier
or NCSP includes information about its ‘security polices, practises and
strategies’ in a SCP, it could help:
... streamline the process of assessing the security risks
associated with each proposed change and ultimately provide the CAC (and ASIO)
with sufficient information to assess whether proposed changes can be
implemented without further engagement with government agencies.[168]
However, the Explanatory Memorandum also notes that submission
of a SCP is ‘not intended to remove the need to engage with ASIO’ either ‘where
this is already occurring or where ASIO considers it necessary’ to ensure a
carrier or NCSP complies with the security obligation.[169]
Interaction between SCPs and individual notification
regime Annual Security Capability Plans
Proposed subsection 314E(1) provides that where an
annual SCP is submitted, the carrier or NCSP is not required to notify those
proposed changes under the individual notification regime. However, proposed subsection
314E(2) does require that where a carrier or NCSP becomes aware of any
modification to proposed changes notified to the CAC through an annual SCP ‘are
likely to have a material adverse effect’ its ability to comply with the
security obligations in proposed subsections 313(1A) and (2A) then
those modifications must be individually notified under proposed section
314A.
Interaction between SCPs and exemptions from the
notification regime generally
Whilst proposed subsections 314A(4)–(7) allow the
CAC to provide exemptions from the notification obligation, this does not apply
to the SCP process as it is not mandatory, with the Explanatory Memorandum
noting that any carrier or NCSP exempted from making individual notifications
for planned changes to telecommunications systems and services ‘would also be
expected not to submit a SCP’.[170]
Assessment of notified proposed changes
Proposed sections 314B (individual notifications) and
314D (annual SCPs) deal with the assessment of proposed changes to a
telecommunications system or service by the CAC.
If the CAC considers that further information about the
proposed change is required to assess whether there is a risk of unauthorised
interference with, or unauthorised access to telecommunications networks or
facilities that would be prejudicial to security the CAC may, in writing,
require the carrier or NCSP to provide such further specified information.[171]
Such a notice must be given to the carrier or NCSP within 30 days of the
individual notification being provided to the CAC, or 60 days of the annual SCP
being given to the CAC.[172]
If after considering an individual notification or annual
SCP or any further information provided in response to a notice issued request
further information, the CAC is satisfied that, in relation to the proposed
change:
-
there is a risk of unauthorised interference with, or
unauthorised access to, telecommunications networks or facilities and
- that risk would be prejudicial to security (as defined by
reference to the definition of that term in the ASIO Act)[173]
then the CAC must give a written notice to the carrier or
NCSP:
- advising
the carrier or NCSP provider of the relevant risk
- setting
out security obligations and
- setting
out the consequences for the carrier or NCSP for not complying with the
security obligations.[174]
Proposed subsections 314B(4) and 314D(4) provide
that a notice issued by the CAC of the above kind ‘may also set out the
measures’ the CAC ‘considers the carrier or provider could adopt to eliminate
or reduce’ the relevant risk.
Proposed section 314B does not prevent a carrier or
NCSP from implementing the proposed change within the 30 day period specified
for the CAC to assess the proposed change or following a notice provided to the
carrier or NCSP by the CAC under proposed subsection 314B(3).[175]
However, when viewed in the context of the powers provided to the
Attorney-General under proposed section 315B, and the (likely) advice
provided by ASIO and other government agencies, arguably a carrier or CSP
should comply with any measures proposed by the CAC to eliminate or reduce the relevant
risk to avoid the risk of potentially breaching the security obligations or
having a direction issued to it by the Attorney-General covering the same or
substantially similar matters.[176]
If, after considering the notification or annual SCP (and
any further information requested) the CAC is satisfied that the proposed
change does not create a risk of unauthorised interference with or access to
telecommunications networks of facilities, the CAC must provide a written
notice to that effect to the carrier or NCSP.[177]
The CAC must issue the relevant notice to the carrier or
NCSP within the following timeframes (as applicable):
- within 30 days (in the case of individual notifications) or 60
days (in the case of annual SCPs) of the individual notification or SCP being
provided to the CAC or
- as soon as practicable and no later than 30 days (in the case of
individual notifications) or 60 days (in the case of SCPs) after the carrier or
NCSP provided further information in response to a request from the CAC.[178]
Importantly, the 30 or 60 day time limit for a formal
response from the CAC runs from when the individual notification or annual SCP
is received but that time-limit effectively ‘re-sets’ each time the CAC
requests further information.[179]
This has attracted some criticism, discussed below.
Criticism of notification regime
Both the individual notification regime and annual SCP
regime have been criticised by stakeholders on a number of grounds.
Logic of the approach
The Associations argued that ‘the basic logic of the
approach’ underpinning the notification regime ‘continues to be fundamentally
flawed’ on the basis:
... if ... C/CSPs have a “duty to do their best to protect
telecommunications networks and facilities from unauthorised interference, or
unauthorised access”, then anything “likely to have a material adverse effect
on their capacity to comply with this duty” cannot exist – irrespective of any
notification and potential subsequent authorisation – without already causing a
breach of the obligation “to do their best to protect”. Doing something that
may adversely affect protection while not breaching the obligation cannot
co-exist with the duty to do one’s best to protect, whether notified or
authorised, or not.[180]
The Associations argued that the principle underpinning
the notification regime should be:
- carriers
and CSPs ‘have a duty to do their best to protect their networks’ and
- where
they ‘seek to do one or more of the following: [list of specific items],
notification is required’.[181]
Asymmetry of the notification requirements
The Associations noted that the proposed notification regime
may require carriers and CSPs to ‘engage with Government early in their
planning, design and procurement activities’ but that the Bill did not impose
an ‘equivalent obligation on Government to proactively notify’ carriers and
CSPs ‘early when it becomes aware of security threats’ to carriers and CSPs telecommunications
networks or facilities.[182]
The Associations argued:
It appears highly inefficient that C/CSPs are obliged to
proactively notify Government of proposed changes to their networks (i.e.,
outsourcing, offshoring, equipment procurement or change in management) and
proposed risk mitigation strategies while Government is not compelled to
equally notify C/CSPs of any potential or real security threats to networks and
facilities. This means that C/CSPs may receive an adverse security assessment
and, consequently, commit scarce resources to developing risk mitigation
strategies based on incomplete or no threat information from Government. This
is an inefficient process and is likely to add to compliance costs which
ultimately will be borne by consumers.[183]
The Associations recommended that the Bill be amended to
require the Government to proactively make carriers and CSPs ‘aware of any
known security threats to their networks and facilities’ through a newly
established ‘single point of truth and advice facility’, such as a Threat
Advisory Service.[184]
Inconsistency with the direction regime
The Associations noted that the requirement that there be
an adverse security assessment before the directions powers can be used by the Attorney-General
does not apply to the notification and consultation processes that precede the issuing
of a direction and argued:
This allows the Attorney-General to apply pressure onto
C/CSPs without a formal basis for doing so.[185]
The Associations recommended that ‘the adverse security
assessment be a prerequisite for the entire process rather than just its last
step’.[186]
Length of time to finalise a decision
As noted above, the Bill provides that the CAC must
respond to individual notifications in 30 days and to SCPs in 60 days. However,
if the CAC seeks further information from the carrier or CSP the Bill provides
for the CAC’s decision-making time period be ‘re-set’ and commence again with a
further full decision-making period (30 or 60 days) starting from when the carrier
or CSP responds to the information request. Optus was critical of this
approach, stating that in response to the second Exposure Draft of the Bill:
This approach raises the prospect of extended overall
decision-making periods (with providers bearing the additional commercial risk
and uncertainty), well beyond the 30 or 60 day periods envisaged in the main
legislative provision. It would be more appropriate for the 30 or 60 day clock
to ‘stop’ for the duration of the period it takes the applicant to respond to
the information request, and then for the ‘clock’ to resume, starting with the
same number of elapsed days as when the information request was made.[187]
The corresponding provisions in the second Exposure Draft
of the Bill provided simply that the CAC must issue a notice ‘within’ 30 or 60
days (as applicable) of the carrier or NCSP providing the further information.
The Bill as introduced contains the additional requirement that the CAC must
respond as soon as practicable and no later than 30 or 60 days
(as applicable) after the carrier or NCSP provided further information.
However, it is not clear that this amendment will fully address the concern
raised by Optus on the second Exposure Draft. Further, in its submission to the
PJCIS on the Bill, Optus noted that the Bill is ‘silent on what occurs if these
timeframes are not met by the CAC’[188]
and argued that ‘this places an unacceptable commercial risk on providers’ and
recommended that the Bill should provide:
The Bill should outline what the outcome will be if the CAC
does not respond with the required timeframe. In Optus’ view, if the CAC does
not respond with a decision within the specified time limits, the notification
or SCP should be deemed agreed unless formal notice is provided by the CAC of
an extended assessment period with a revised notification date. Such a notice
should be open to administrative review and further deadlines so it cannot be
rolled over indefinitely.[189]
Unnecessary interference with commercial decisions of
carriers and CSPs
Vodafone Hutchison Australia (Vodafone) argued that the
notification regime, along with other aspects of the Bill, would ‘dramatically
impact the incentives for outcomes orientated collaboration and impose
significant costs and commercial risks into the telecommunications industry’.[190]
TPG Telecom Limited Group also expressed similar concerns
and argued that the proposed notification regime is ‘unreasonably lengthy and
is intrusive on the ordinary operations of the Telco’.[191]
Offshoring
Macquarie Telecom noted that whilst it ‘very concerned at
the prospect of the costs and intrusion into its commercial operations’ resulting
from the regime proposed by the Bill, it ‘takes a different view in relation to
the potential impact the legislation may have on the practice of offshoring
infrastructure’.[192]
Macquarie Telecom noted:
Macquarie Telecom considers that the benefits of retaining
certain types of data within Australia outweigh any additional costs of using
onshore infrastructure and services... Macquarie Telecom Group contends that
Australian based services and infrastructure can be efficient, innovative and
cost effective. From a security and intelligence perspective, Australian based
services and infrastructure can allow a high degree of collaboration and access
between industry and security agencies (within an appropriate framework).[193]
Macquarie Telecom concluded that there is ‘significant
risk in offshoring certain data and considers it important that Australia
retains sovreignty [sic] over certain types of information’.[194]
However, overall Macquarie Telecom nonetheless expressed concern over ‘the real
possibility’ that the Bill ‘could stimie [sic] its ability to innovate and
respond to changes in technology and customer demand’ and ‘could lead to
increased security threats as the implementation of new technology is delayed
or deferred due to concerns about any approvals required from Government’.[195]
Despite Macquarie Telecom’s concern, the principal concern
of industry stakeholders in relation to the offshoring of services or equipment
appears to be that the security obligation would impose a legal obligation on
carriers and CSPs to exert control over aspects of networks and facilities that
they use, including those located offshore, over which they may not have legal
or physical control.
It is argued that this requirement may limit the extent to
which carriers and CSPs can utilise offshoring arrangements, which could reduce
Australia’s international competitiveness with respect to investment and
innovation in the telecommunications sector. For example, the security
obligations of carriers and CSPs under the Bill might be incompatible with the
laws of the foreign jurisdiction in which the network or facility is located,
such as obligations to provide assistance to law enforcement or intelligence
agencies of that foreign country (or potentially its allies). It is also
possible that a carrier or CSP may not have ownership of the relevant
infrastructure and therefore cannot take the steps considered necessary to
protect the network.[196]
The CEO of the Communications Alliance, Mr John Stanton,
also gave evidence to the PJCIS that the offshore storage of data did not, in
his organisation’s opinion, present an elevated security risk compared to
onshore storage:
Senator McKENZIE: ... My question goes to managing risk
and the increasing propensity of our Australian providers to offshore aspects
of their operations and the subsequent increase in risks in that for all of
us—not just you but also us. It is something that we need to manage. Also, you
are obviously offshoring as a result of competitive tensions. Are there things
we need to change in the bill to address that, or are you comfortable with the
measures within the bill around your need to offshore certain aspects—and
increasingly it seems that the trend continues—and our ability to manage the
risks to the Australian public?
Mr Stanton : ...I will start with the underlying
premise, which is that offshoring is inherently more risky than storing data
onshore. To my mind it is not so much about geography; it is about security and
the robustness of the arrangements that you have got in place, whether they be
in Australia or offshore.[197]
However, in contrast the draft guidelines appear to
indicate that the practice of offshoring necessarily raises security concerns
because it creates a greater level of vulnerability to espionage and sabotage:
Offshoring raises security concerns because it enables access
and control to critical parts of major Australian telecommunications networks
outside of Australia, this can facilitate foreign intelligence collection
(espionage) and disrupt the network itself (sabotage). Risks arise where
control and supervision arrangements have the potential to allow unauthorised
actions by third parties, such as theft of customer data or sabotage of the
network.[198]
The draft guidelines further identify some specific
security vulnerabilities presented by offshoring arrangements, which appear to
focus on the outsourcing or sub-contracting of some of a carriers or CSPs activities
to third party providers located overseas: The draft guidelines state:
Foreign solutions often function in different legal and
cultural environments which present a number of potential national security
risks and vulnerabilities, further exacerbated by an operator's lack of
security visibility or involvement in:
- the use of cloud services and infrastructure, and
where they are located
- equipment running out of a foreign country and
integrated back into the main network of an operator in Australia
- staff recruitment (including staff vetting processes)
where the general culture around these processes may not be on par with
Australian requirements, noting that the staff may also not share a sense of
corporate loyalty to the operator
- the procurement and management of third party
equipment vendors
- a solution being run under a vendor's security policy,
which may not align with Australian legislation, best practice and/or existing
compliance requirements or with the operator's own risk profile.
C/CSPs should seek specific guidance from government agencies
if they are unsure of the particular risks posed by their existing and planned
supplier arrangements.[199]
As such, the security of data retained offshore and the
use of offshore service providers by carriers and CSPs would appear to be
unresolved issues of concern to a range of stakeholders.
Unclear thresholds and unnecessarily broad scope of
application
Optus argued that the notification obligations imposed by proposed
subsections 314A(1) and 314C(2) are ‘expressed in a way that creates
a logic trap and an associated compliance risk for providers which is not satisfactory’. [200]
Optus also expressed concern about how that threshold would be applied and how
the decisions of carriers and CSPs would be viewed, noting that if (based on
the information it has available) a carrier or CSP forms a view that change is
not notifiable and proceeds on this basis:
- it
runs the risk ‘that some ‘after-the-event’ investigation’ by the CAC will draw
a different conclusion and
-
therefore be found to have breached the notification and security
obligations, even though the security assessment may have been based on
information which the CAC (or a security agency) conducting such an
investigation had ‘uniquely available to it and to which the provider was not
privy when considering the threshold question’.[201]
As a result, Optus recommend that the drafting of proposed
subsections 314A(1) and 314C(2) should be reviewed to take into
account the above concerns.[202]
Foxtel also noted that the notification requirements in proposed
section 314A may also apply to ‘its broadcasting and content infrastructure
and facilities’.[203]
Foxtel therefore sought ‘clarification that networks and facilities used to
supply broadcasting and content services are not intended to be subject to ...
the notification requirements in section 314A’.[204]
Foxtel argued that because broadcasting and content
services do not carry sensitive corporate or government information or
sensitive, confidential information about law enforcement activities, protected
information or potentially disclose the location of politicians or other
protected persons and they are not essential to the delivery and support of
critical services, such as, power, water and health they should be excluded
from the security and notification obligations. As result, Foxtel recommended
that proposed section 314A be amended to expressly exclude networks and
facilities to the extent that these are used to supply broadcasting services
and content services (as defined by the Broadcasting Services Act 1992)
from the notification requirements.[205]
Foxtel argued that such amendments would ‘provide clarity
and certainty in relation to the application of the regulatory framework in
future’.[206]
In that regard it is worth noting that the Explanatory Memorandum notes that it
is envisaged that ‘classes of providers may be exempt from the notification
requirement’ potentially including subscription television services (see the
discussion above under the heading ‘Exemptions from the notification
obligation’).[207]
This would appear to suggest an intention to deal with this issue via
exemptions granted by the CAC, and the proposal to develop an approach to the
granting of exemptions during the implementation phase.
Directions by the Attorney-General
Current position
Currently subsection 581(3) of the Act provides that the
Attorney-General may (after consulting the Prime Minister and Minister
administering the Act[208])
direct a carrier or CSP to cease operating a telecommunications service where
the proposed or continued operation of that service is, or would be,
prejudicial to security. The Explanatory Memorandum notes that the power
provided under subsection 581(3) of the Act is:
... an extreme measure and only appropriate for managing the
most extreme national security risks given the potentially significant flow on
consequences for the affected company’s business, their customers, and possibly
the broader Australian economy. For these reasons the power has not been exercised
to date.[209]
Subsection 581(4) of the Act provides that a person must
comply with a direction given under subsection 581(3). In turn, compliance with
the Act (and hence directions issued under subsection 581(3) area standard
licence condition (as per item 1 of Schedules 1 and 2 to the Act). This means
that non-compliance with a direction issued under section 581 of the Act may
amount to a breach of licence conditions. It may also be a civil penalty
provision and attract other remedial action under section 68-69 and 101-102 of
the Act. Collectively this means that such directions have a degree of
regulatory force to ensure compliance. However, current subsection 581(3A) of
the Act prevents the power from being expressed ‘to apply to the supply of a
carriage service to a particular person, particular persons or a particular
class of persons’.
The Bill repeals subsections 581(3) and (3A) of the Act in
order to re-locate it within the TSSR framework in proposed Division 5 of Part
14.[210]
Proposed section 315A largely replicates the power in existing
subsection 581(3), with some procedural changes. The Bill will also grant the
Attorney-General a new and separate directions power to direct a carrier or CSP
to do or refrain from doing something.
Power to require a carrier or CSP to cease operating a
telecommunications service
The first power (provided in proposed section 315A)
is modelled on existing subsections 581(3) and (3A).[211]
It allows the Attorney-General to direct a carrier or CSP to cease operating a
telecommunications service where the proposed or continued operation of that
service is, or would be, prejudicial to security (‘shutdown power’).
Whilst it is modelled on existing subsections 581(3) and
(3A), and is not intended to change the operation or effect of the power, there
are some differences relating to the issuing requirements, and provisions for
the statutory judicial review of decisions to issue directions.[212]
The first difference is that ASIO must have issued an adverse security
assessment before the Attorney-General can exercise the power.[213]
The second difference is that the current limitation on judicial review of a
direction under the ADJR Act is removed.[214]
These are discussed below.
However, prior to discussing those differences it is worth
noting that proposed subsection 315A(2) replicates existing subsection
581(3A) and hence will prevent the Attorney-General from issuing directions
that apply to a particular person, particular persons or a particular class of
persons—they must apply to a carrier or CSP generally.
When a direction to cease operating a telecommunications service
is given to a carrier or CSP, a copy of the direction must be provided to the
ACMA and proposed subsection 315A(5) provides a person must comply with
the direction.[215]
In turn, compliance with the Act (and hence directions issued under proposed
section 315A) area standard licence condition (as per item 1 of Schedules 1
and 2 to the Act). This means that non-compliance with a direction issued under
proposed section 315A of the Act may amount to a breach of licence
conditions. It may also be a civil penalty provision and attract other remedial
action under section 68-69 and 101-102 of the Act. Collectively this means that
such directions have a degree of regulatory force to ensure compliance.
It is also worth noting that the Explanatory Memorandum
states that the directions power is:
... intended to be used in the most extreme circumstances where
the continued operation of the service would give rise to such serious
consequences that the entire service needed to cease operating.[216]
Further, the Government also notes that in relation to the
directions power provided by current subsection 581(3) of the Act (which does
not contain the limitations on its exercise that proposed section 315A has)
that ‘it is such an extreme measure that it has never been used’ and that it is
‘designed for use in exceptional or extreme cases only to prevent harm to
Australia’s interests’.[217]
This would suggest that the ‘shut down’ power contained in proposed section
315A is also only designed for use in exceptional or extreme cases, only to
prevent harm to Australia’s interests, and only when there has been an adverse
security assessment provided by ASIO. In other words, the ‘shut down’ power
proposed by the Bill will be more limited (and will have greater review and
appeal rights) than the current power provided by subsection 581(3) of the Act.
Requirement for an adverse security assessment from ASIO
The first difference is a new restriction on the powers is
provided under proposed subsection 315A(3): a direction cannot be issued to a
carrier or CSP unless an adverse security assessment in respect of the relevant
carrier or CSP is given to the Attorney-General. This is a change from the
current regime, where there is no requirement for an adverse security
assessment prior to issuing a direction under section 581 of the Act.
Briefly, security assessments are a means by which ASIO
provides advice. They only consider factors related to ‘security’ and ‘are not
character checks and factors such as criminal history, dishonesty or deceit are
only relevant to ASIO’s advice if they have a bearing on security
considerations’.[218]
An adverse security assessment is where ‘ASIO recommends that a prescribed
administrative action be taken ... or not taken’.[219]
In the context of the proposed TSSR regime, a ‘prescribed administrative
action’ could relate to approving SCP (and hence proposed changes) or issuing a
direction to a carrier or CSP.
Adverse security assessments are subject to merits review
under Division 4 of Part IV of the ASIO Act. The notification
requirements under s 38A of the ASIO Act also apply.
Allowing review of directions under the ADJR Act
The second difference is that decisions to issue
directions made under proposed section 315A will now be subject to
judicial review. Item 32 of Schedule 1 of the Bill removes the
limitation currently imposed on directions issued under subsection 581(3) of
the Act. The Explanatory Memorandum notes:
Currently, while judicial review of a direction to cease a
service would likely be available through the High Court’s original
jurisdiction, the process is more complicated and does not provide as many
grounds of review. Removing the current exemption will enable a C/CSP to seek
judicial review under the ADJR Act and therefore increase the transparency and
accountability of the direction process. It will also align with the review
rights provided under the new directions power in subsection 315(2) which will
also provide for judicial review under the ADJR Act.[220]
Power to require a carrier, CSP or intermediary to do or
refrain from doing a specified act
The second power, provided in proposed subsection
315B(2) allows the Attorney-General to direct a carrier, CSP or
intermediary to do or refrain from doing a specified act. The relevant act must
be connected to:
- the
operation by a carrier or CSP of telecommunications networks or facilities or
- the
supply of a carrier service by a carrier or CSP (or when supply is arranged by
an intermediary).[221]
To exercise the power, the Attorney-General must be
satisfied:
- there
is, in connection with one of the above activities:
- a
risk of unauthorised interference with, or unauthorised access to, telecommunications
networks or facilities
- the
risk would be prejudicial to security (by reference to the meaning of that term
in the ASIO Act) and
- requiring the carrier, CSP or intermediary to do, or refrain from
doing, the specified act or thing is reasonably necessary for purposes relating
to eliminating or reducing the abovementioned risk.[222]
‘Prejudicial to security’ means activities relevant to
security, which can reasonably be considered capable of causing damage or harm
to Australia, the Australian people, or Australian interests, or to foreign
countries to which Australia has responsibilities.[223]
The Explanatory Memorandum notes that the power in proposed
section 315B ‘is intended to reduce the need to rely on the existing powers
under subsection 581(3) of the Act’ (and therefore also proposed section
315A). The Explanatory Memorandum also notes that it ‘is intended to be
used in a cooperative way alongside engagement with industry’ but ‘it is
expected this power will be used only as a last resort to achieve compliance’
or where ‘C/CSP would prefer the certainty of a formal direction’.[224]
Whilst proposed section 315B ‘is an intrusive power’[225]
it is subject to a number of thresholds and safeguards.
First, proposed subsection 315B(4) provides that a
direction cannot be issued by the Attorney-General unless they have received an
adverse security assessment in respect of the carrier, CSP or intermediary (for
discussions regarding adverse security assessments, refer to ‘Requirement for an adverse security assessment from ASIO’ above, which is equally
applicable to proposed section 315B).
Second, proposed subsection 315B(3) provides the
Attorney-General must be satisfied that providing a direction is ‘reasonably
necessary’ for the purposes of eliminating or reducing the risks of
unauthorised interference with (or access to) telecommunications networks or
facilities that would be prejudicial to security.
Third, proposed subsections 315B(5) and (8)-(10) provide
that a direction cannot be issued by the Attorney-General until:
- they
have consulted the Minister administering the Act (and any other persons the
Minister sees fit)[226]
- gives to the carrier, CSP or intermediary a written notice setting
out the proposed direction that includes an invitation to make written
representations to the Attorney-General in relation to the proposed direction
within the period specified in the notice (which must be at least 28 days after
the notice is given, unless the Attorney-General specifies a shorter period
because he or she considers it necessary to do so because of urgent
circumstances)[227]
- has
had ‘regard to any such representations made within that period’[228]
- they are satisfied that reasonable steps have been taken to
negotiate in ‘good faith’ with the carrier, CSP or intermediary ‘to achieve an
outcome of eliminating or reducing’ the relevant risk[229]
and
- has
had regard to the matters listed in proposed subsection 315B(6) (discussed
below).
Requirement to consult with other Ministers
Proposed subsection 315B(8) provides that the
Attorney-General must consult with the Minister administering the Act before
issuing a Direction. Proposed subsection 315B(10) then provides that proposed
subsection 315B(8) does not limit the persons with whom the
Attorney-General may consult, prior to issuing a Direction. The Explanatory
Memorandum notes that this mandatory consultation requirement and flexibility
to consult with other persons is designed to ensure:
... the exercise of the power takes into account broader
communications policy considerations, for example, any potential impact on the
telecommunications sector, including effects for competition... This requirement imposes
a high degree of scrutiny and accountability on the Attorney-General’s exercise
of this power. Mandatory consultation with the Minister for Communications
highlights the significance of the decision and will ensure a range of views
inform the Attorney-General’s exercise of the directions power and the
Attorney-General takes into account factors such as the potential impact for
the affected C/CSP, end-users and the economy more broadly.[230]
By way of example, the Explanatory Memorandum explains
that proposed subsection 315B(1) would allow the Attorney-General to
consult with other Ministers with an interest ‘such as the Minister for Foreign
Affairs and Trade where there are international sensitivities’ and that this
would result in directions being ‘informed by the advice of other security
agencies and relevant government agencies’ through such consultations.[231]
However, proposed paragraph 315B(8)(b) also imposes
mandatory consultation with the affected carrier or CSP. This is because the
Attorney-General is required to write to the carrier or CSP and notify them of the
intention to issue a Direction. However in addition, the Attorney-General must
also provide a draft Direction, and provide the carrier or CSP the opportunity
to make written representations about it. In practice, the Attorney-General
will ‘generally provide the C/CSP with a copy of the draft direction at the
time he/she provides the ASIO security assessment (as required under the ASIO
Act)’.[232]
When the above procedures are considered, it is apparent
that it is possible for:
- an
adverse security assessment to be provided to the carrier or CSP and
- at
some later point in time, the Attorney-General to provide the carrier or CSP
with the draft Direction.
Whilst it could be argued that the material in the adverse
security assessment may allow a carrier or CSP to start processes and steps to
ensure compliance with its TSSR obligations related to the contents of the
adverse security assessment, alternatively it could be argued that a more
efficient method would be to include a statutory obligation to provide the
draft direction at the same time the carrier or CSP is notified about the
adverse security assessment, rather than the as part of the (presumably later)
notice requirement in proposed subparagraph 315B(8)(b)(i).
Requirement
to negotiate in ‘good faith’ with the carrier, CSP or intermediary
In relation to the requirement to negotiate in ‘good faith’
with the carrier, CSP or intermediary ‘to achieve an outcome of eliminating or
reducing’ the relevant risk imposed by proposed subsection 315B(5), the
Explanatory Memorandum states:
Good faith in this context is intended to impose a
requirement that engagement is genuine and solutions-focussed and all
reasonable options for addressing the risk are considered by both parties. This
provision is intended to underpin the entire objective of the security
framework which is to facilitate cooperative and collaborative government and
industry partnership to manage national security risks to the telecommunications
sector.[233]
In addition to the good faith requirement that underpins
consultations with the potentially affected carrier, CSP or intermediary, proposed
subsection 315B(9) requires that (absent urgent circumstances) the
consultation period must be ‘at least’ 28 days after the proposed direction is
given. This means that, barring where the Attorney-General considers it
necessary to shorten the consultation period due to urgent circumstances, a
carrier, CSP or intermediary will generally have adequate time to consider the
draft Direction and adverse security assessment, and potentially seek a merit
review of the adverse security assessment (which would in effect stay ‘the
process for issuing a direction’).[234]
Reflecting the gravity of the direction power, the Explanatory Memorandum
notes:
... the Attorney-General’s power to issue directions under
sections 315A or 315B cannot be delegated (unlike the Secretary of AGD’s
information-gathering powers under section 315C which may be delegated to the
Director-General of Security– see notes on Division 6 below). There is also
no implied power to authorise an official to exercise the power to issue
directions on the Attorney-General’s behalf.[235]
(emphasis added)
Proposed subsection 315B(6) provides that in
addition to the above, the Attorney-General must, before issuing a direction,’
have regard to the following matters:
- the
adverse security assessment
- the
costs, in complying with any direction, that would be likely to be incurred by
the carrier, CSP or intermediary
- the
potential consequences that any direction may have on competition in the
telecommunications industry
- the
potential consequences that any direction may have on customers of the carrier,
CSP or intermediary.
The subsection also provides that ‘the Attorney-General
must give the greatest weight to the matter’ mentioned in proposed paragraph
315B(6)(a): the adverse security assessment.
Proposed subsection 315B(7) provides that proposed
subsection 351B(6) does not limit the matters to which the Attorney-General
may have regard (that is, the mandatory considerations do not preclude the
Attorney-General from having regard to other considerations at his or her
discretion).
It is unclear on the face of the provisions whether any
discretionary considerations taken into account—consistent with the recognition
in proposed subsection 315B(7)—would also be subject to the requirement
in proposed subsection 315B(1) that the Attorney-General must give the
greatest weight to the adverse security assessment.
It appears that the requirement to give greatest weight to
the adverse security assessment is limited to the mandatory considerations in proposed
subsection 315B(6). If this interpretation is accepted, then it would
theoretically be open to the Attorney-General to place a greater degree of
weight on discretionary considerations as determined in the circumstances of
individual cases, as compared to an adverse security assessment (and any other
mandatory considerations) prescribed by proposed subsection 315B(6).
In the absence of explanation in the EM, it is unclear
whether this result is intended.
Criticisms of the directions powers
Both the directions powers contained in proposed
sections 315A and 315B have been criticised on various grounds.
Potential to undermine investment decisions and reduce
competition
A number of stakeholders expressed a view that the powers
contained in proposed sections 315A and 315B amounted to
inappropriate interference in the commercial decisions of telecommunications
companies.
For example, TPG stated that the power to ‘tell Telcos
what to do about their networks and facilities’ will ‘undermine sound
investment decisions made by industry’.[236]
Further, TPG also argued that there is a risk that that decisions about whether
to issue a Direction ‘could be inappropriately influenced by the prevailing
socio-political climate or the relationship (or lack of a relationship) with
the Government of the day’ instead of being ‘based on the need to promote
network security’ (so that vendors of equipment are motivated to compete based
on their security credentials)’.[237]
Likewise, Vodafone argued that the use of the directions
power ‘potentially limits competition especially where the pool of technology
vendors for particular equipment is in low single digits, increasing the chance
that this draconian approach runs afoul of anti-competition laws’.[238]
Inappropriate weighting given to adverse security
assessments
A number of stakeholders expressed concerns at the factors
that the Attorney-General must consider before issuing a Direction in proposed
subsection 315B(6) and the emphasis placed on the adverse security
assessment.
For example, TPG noted that whilst the power to issue a
Direction under proposed section 315B is limited to circumstances where
the Attorney-General has received an adverse security assessment ‘this does
little to limit the potential favouring of one particular manufacturer of
equipment, or a particular country’s manufacturer, as against other
manufacturers’.[239]
TPG also argued that whilst the power provided by proposed section 315B to
direct a carrier, CSP or intermediary to do or refrain from doing specified
acts requires the Attorney-General to have regard to the compliance costs and
burdens and competition implications ‘the Attorney General is free, and is
indeed required, to discount such considerations in favour its consideration of
the adverse security assessment’.[240]
Optus likewise noted that the Attorney-General must give the greatest weight
the adverse security assessment and argued:
... this decision-making “bias” be removed by deleting this
sentence. If it is retained, the most likely practical outcome would be for
this factor to dominate decision-making. This outcome would have the effect of
undermining the point of including the factors (b), (c) and (d) in the list of
decision-making factors in the first place. It is critical that this coercive
power only be exercised in the full understanding of its practical impact and
for these other aspects to be given suitable weight and potential to influence
decisions.[241]
Optus also recommended that proposed subsection 315B(6)
be amended to include a new paragraph (e) which would require the
Attorney-General to consider ‘whether the network or service to which the
proposed direction would apply is critical national infrastructure or a
critical service’.[242]
Optus argued that such an amendment would:
... ensure decision-making takes into account a view, not just
of costs, customer impact, competition and security as currently proposed, but
also the significance of the infrastructure or criticality of the service in
the national context and in the context of the network and services which the
providers offers to the public in Australia. The addition of this factor would
also assist to align the exercise of the power to give directions with the
stated policy intent of protecting critical national infrastructure.[243]
Vodafone also argued that despite the obligation to
negotiate in good faith before issuing a Direction, the directions powers posed
a risk that agencies would ‘invoke the security assessment as a reason not to
collaborate with a service provider to find more reasonable and just as
effective national security outcomes’ and this would in turn limit competition.[244]
In relation to concerns about the weighting given to
adverse security assessments in proposed subsection 315B(6) the
Government notes:
The harm to security is to be given the greatest weight in
this balancing exercise to ensure that Australia’s security interests are
properly safeguarded despite potential impacts on the C/CSP, competition and
end-users. The requirement to have regard to other factors, in addition to the
risk to security, will ensure that a direction is proportionate and
reasonable in all of the circumstances and guard against imposing
directions that would possibly address security risks but have an unnecessary
crippling effect on the C/CSP’s business or impede market innovation and
competition.[245]
As such, it appears that the Government has (through the
consultation process regarding the ED) considered the stakeholder concerns
discussed above and determined that as the reforms are aimed at ensuring
security, proposed subsection 35B(6) aims to ensure that a balance
between security issues and non-security issues such as cost and competition is
struck, without necessarily requiring equilibrium between those factors.
The impact of uncertain definitions and the opacity of
adverse security assessments
The LCA noted that the rule of law is predicated on the
basis that laws are both readily known and available, and certain and clear. In
that regard, in relation to the thresholds proposed by the Bill the LCA noted
that ‘any process that may result in substantial impacts on providers and
potentially the services provided to consumers must be, to the extent possible,
transparent.’[246]
The LCA argues that because issuing of an adverse security
assessment is not required to be based on conventional standards of proof such
as a 'balance of probabilities' test and the specific criteria by which ASIO
make their assessments are also largely unknown (beyond that it must relate to
ASIO's functions and the definition of security in section 4 of the ASIO Act)
the proposed provisions resulted in uncertainty:
... as to when a cyber risk or threat will be considered to be
of a sufficient level of seriousness to warrant the issuing of a direction by
the Attorney-General.[247]
The LCA concluded that as it was also ‘unclear whether a
risk or prejudice to security must be substantial, likely, imminent or of
severe potential impact before an adverse security assessment is issued’ that
the threshold was not sufficiently transparent and recommended:
... the exercise of the directions powers should only be
permitted where there is a sufficient level of risk to security to justify the
exercise of the powers. This could be achieved, for example, by amending
subsection 315B(1) to require that the Attorney-General is satisfied that there
is a substantial and imminent risk of unauthorised interference with, or
unauthorised access to, telecommunications networks or facilities that would be
prejudicial to security.[248](emphasis
added).
The LCA also noted that the definition of ‘prejudicial to
security’—which forms part of the thresholds that must be satisfied before the
shut down or directions power can exercised—is not defined in the Bill itself.[249]
The meaning of ‘prejudicial to security’ is not defined in the ASIO Act,
but is instead defined in guidelines issued under section 8A of that Act as meaning
activities relevant to security, which can reasonably be considered capable of
causing damage or harm to Australia, the Australian people, or Australian
interests, or to foreign countries to which Australia has responsibilities.[250]
The LCA again reiterated that ‘the rule of law requires
that the law must be both readily known and available, and certain and clear’
and that ‘this requires that key terms should be defined’.[251]
The LCA therefore recommended that the term 'prejudicial to security' should be
defined in the legislation itself so as to ensure:
- that the definition of 'prejudicial to security' could not be
redefined without ‘adequate Parliamentary scrutiny’ and
- that the Attorney-General's directions powers under proposed
subsections 315A(3) and 315B(4) could only be exercised in the
circumstances intended by the Explanatory Memorandum.[252]
Whilst legislative certainty regarding definitions is an
often-sought goal, a statutory definition of ‘prejudicial to security’ may have
adverse security implications because it would require the Parliament to decide
the relevant criteria in the abstract, necessarily without the benefit of
intelligence about threats to Australia’s security (as well as without the
detailed knowledge of the security environment that the Attorney-General would
possess due to his or her portfolio responsibility for ASIO). This is why the ASIO’s
guidelines are non-legislative instruments, as recommended by the Hope Royal
Commission in 1984, and are partially classified (as a compromise, the
unclassified portions must be tabled in Parliament under section 8A of the ASIO
Act).
Lack of consultation requirement in shutdown power
TPG noted that in contrast to the direction power
contained in proposed section 315B (which requires the Attorney-General
undertakes good faith negotiations with carriers, CSPs or intermediaries before
issuing a direction) the shutdown power provided by proposed section 315A
could be exercised by the Attorney-General without any need to consult with the
impacted carrier, CSP or intermediary.[253]
TPG argued that the shutdown power ‘should be subject to judicial oversight
rather than just a bare power for the executive branch’.[254]
The Government argues that the directions power in proposed
section 315B is intended to supplement the shutdown power in proposed
section 315A and hence is aimed at enabling ‘other action to be taken to
address a security risk where the circumstances do not require the complete
shut-down of the service’.[255]
As such, the shutdown power provided by proposed
section 315A ‘will remain the ultimate protection measure where action
needs to be taken immediately to protect Australia’s security interests’ and
therefore:
For these reasons, some of the additional requirements and
protections included in the new directions power under section 315B, for
example the Attorney-General must be satisfied all reasonable steps have been
taken to reach agreement and consult the affected C/CSP in good faith, are not
replicated in the existing provision. However, alternative safeguards are
provided for use of the power under section 315A through the requirement to
consult the Prime Minister, in addition to the Minister responsible for
administering the Telecommunications Act, the Minister for Communications.[256]
Whilst as noted above, TPG argues that the shutdown power
should be subject to judicial oversight, decisions to issue a direction under proposed
section 315A can be challenged through:
- a merits review of the adverse security assessment (which is a
necessary pre-condition of giving a direction) and
- judicial
review of the decision to issue a direction itself.[257]
Information gathering and sharing powers
The Bill proposes to give the Attorney-General’s Secretary
(Secretary) a number of coercive information gathering powers, as well as
information sharing powers, in relation to assessing compliance with the new
security obligations imposed by proposed subsections 313(1A) and 313(2A)
inserted by items 8 and 9 (discussed above).
Power to obtain information or documents
Proposed section 315C provides that when the
Secretary ‘has reason to believe’ that a carrier, CSP or intermediary has
information or a document that is relevant to assessing compliance with the
security obligations they may issue a written notice requiring them to give the
Secretary:
- any
information or documents (in a form specified) within a specified time-period
or
- copies
of documents (in a form specified) and produce them within a specified
time-period.[258]
However, proposed subsection 315C(4) provides that before
the Secretary (or the Director-General of Security in the event that the
Secretary delegates his or her powers to the Director-General)[259]
issues such a notice, they must ‘have regard to’ the costs that would be
incurred by the carrier, CSP or intermediary in complying with the notice. Proposed
subsection 315C(5) provides that proposed subsection 315C(4) does not limit
the matters to which the Secretary (or the Director-General as the Secretary’s
delegate) may have regard at their discretion. Once issued, proposed
subsection 315C(3) provides that a person must comply with such a notice.
This means that non-compliance with a Direction issued
under proposed section 315CA of the Act may amount to a breach of
licence conditions. It may also be a civil penalty provision and attract other
remedial action under sections 68–69 and 101–102 of the Act. Collectively this
means that such directions have a degree of regulatory force to ensure
compliance.[260]
Content of notice to produce information or documents
Proposed subsections 315C(6) and (7) provide
that if a notice to produce information or documents is issued, it must set out
a number of matters including:
- if
the notice is issued to a carrier:
-
the
effect of proposed subsection 315C(3) (which requires a person to
comply with the notice)
- section
68 of the Act (a carrier or person must comply with the conditions of its
carrier licence—which includes compliance with the Act, TIA Act and
other legislation)[261]
- section
570 of the Act (which sets out the pecuniary penalties for contravention of the
Act’s civil penalty provisions)
- Part
1 of Schedule 1 of the Act (which provides that a standard conditions of a
carrier licence includes compliance with the Act TIA Act and other
legislation)[262]
- Sections
137.1 and 137.2 of the Criminal Code (which are offences for providing
false or misleading information or documents)
- if
the notice is issued to a CSP or an intermediary:
-
the
effect of proposed subsection 315C(3) (which requires a person to
comply with the notice)
- section
101 of the Act (a service provider must comply with the service provider rules—which
includes compliance with the Act, TIA Act and other legislation)[263]
- section
570 of the Act (which sets out the pecuniary penalties for contravention of the
Act’s civil penalty provisions)
- Part
1 of Schedule 2 of the Act (which provides that a service provider rule
includes compliance with the Act TIA Act and other legislation)[264]
- Sections
137.1 and 137.2 of the Criminal Code (which are offences for providing
false or misleading information or documents).
Availability of compensation
Proposed subsection 315C(8) provides that a
carrier, CSP or intermediary is entitled to be paid ‘reasonable compensation’
for complying with a requirement to provide copies of a document to the
Secretary under proposed paragraph 315C(2)(c). In contrast, no
compensation is available for compliance with a notice to produce information
or documents issued under proposed paragraphs 315C(2)(a) and (b).
This approach is consistent with section 523 of the Act
(in relation to the ACMA’s information-gathering powers). This may suggest an
intention that compensation is for the costs of producing copies, rather than
foregone productivity or other business costs as a result of searching for and
producing documents, or providing information in compliance with a notice.
Abrogation of privilege against self-incrimination
The information-gathering power in proposed section
315C (combined with the provision on self-incrimination in proposed
section 315D, discussed below) will operate to override reasons for
non-disclosure and compel the provision of information or documents. The
compulsion element has the effect of authorising the disclosure of personal
information under the Privacy Act (that is, the disclosure is authorised
by law) and offers a statutory protection for breach of confidentiality
provisions in contracts.
Proposed subsection 315D(1) abrogates the privilege
against self-incrimination by providing that a person is not excused from
giving information or providing a document (or a copy of a document) under proposed
section 315C on the grounds it might tend to incriminate the person or
expose them to a penalty.
However, as is relatively common with such types of
coercive powers, the abrogation of the privilege against self-incrimination is
accompanied by ‘use’ and ‘derivative use’ immunities.[265]
Proposed subsection 315D(2) provides that where such information is
given or a document (or copy of a document) is provided under proposed
section 315C that information, document or copy or any information,
document or thing obtained as a direct or indirect consequence of giving the
information, document or copy is not admissible in evidence against the
individual who provided it in:
- criminal proceedings other than proceedings for an offence
against sections 137.1 and 137.2 of the Criminal Code (offences for
providing false or misleading information or documents) or
-
civil proceedings other than proceedings under section 570 of the
Act related to the recovery of a penalty for contravening proposed
subsection 315(C)(3) (failing to comply with a notice to give information,
provide a document or copy).
Information sharing
Proposed section 315H authorises the further use or
disclosure of information or documents obtained under proposed sections
314A, 314B, 314C, 314D, 315C and 315H to persons other than the
Secretary or their delegate.
However, proposed subsection 315H(1) provides that
any such disclosure must be either for the purpose of assessing compliance with
the security obligations or for the purposes of security (within the meaning of
that term in the ASIO Act). The Government notes:
In practice it is likely that information sharing may take
place between relevant government agencies, such as with the Department of
Communications and the Arts or the Australian Signals Directorate. For example,
information or documents may be shared in cases where technical expertise or
assistance is required to assess risks to security. It may also be used to
inform the Attorney-General or other relevant Ministers for the purpose of
exercising the Attorney-General’s power in new section 315A (previously
subsection 581(3), or more broadly for the purposes of security. ‘Security’ is
defined by reference to the ASIO Act. The powers would therefore also
potentially authorise sharing of information or documents with state
authorities and international partners, pursuant to the ASIO Act and formal
information sharing arrangements with those countries.[266]
In addition to the above restriction on the purposes of
disclosure, proposed subsection 315(2) provides that a person must not
disclose information or documents obtained under proposed sections 314A,
314B, 314C, 314D, 315C and 315H to the extent the information is
‘identifying information’ or the document (or copy) contains ‘identifying
information’ to persons who are not are not Commonwealth officers (some
stakeholders criticised the breadth of the definition, as discussed below).[267]
The term ‘identifying information’ is defined in proposed subsection
315H(4) as ‘information that identifies the carrier, carriage service
provider or carriage service intermediary concerned’. Proposed subsection
315H(3) provides that, subject to the disclosures permitted under section 315H,
a person who obtains information or a document under proposed sections 314A,
314B, 314C, 315C or 315H must treat that information or document as
confidential.
Protection of commercially sensitive information
The intent of proposed subsection 315H is to enable
the disclosure of information as necessary for the purposes of security, while
also protecting commercially sensitive information provided by carriers, CSPs
and intermediaries. It seeks to balance interests in security and the
confidentiality of commercially sensitive information primarily by requiring
the Secretary, Director-General of Security or other Commonwealth officers who
have access to the information or documents to remove information that
identifies the carrier, CSP or intermediary before sharing them outside of the
Australian Government.[268]
The Government notes:
In practice, information would only likely be shared outside
Commonwealth Government officials for reasons of providing threat information
and intelligence to foreign partners in support of reciprocal information
sharing arrangements. Australia is dependent on intelligence provided under
these arrangements to support preparation of its own threat advice to
Australian companies. C/CSPs will not be advised when information is shared with
foreign partners as this could potentially compromise national security by
identifying the types of issues considered by security agencies and the nature
of sharing arrangements.
Only information that does not identify the C/CSP (i.e. the
threat-based information) would be shared in these circumstances and
information shared in these circumstances is protected through formal
arrangements such as a Memorandum of Understanding. In practice, this would
involve removing the identifying details of the C/CSP such as company name and
logo before the information or documents are shared ... Information and documents
would be shared with other security agencies and foreign intelligence partners
to better protect national security. It would not be shared with a C/CSP’s
competitors or with other stakeholders who may gain a commercial advantage from
seeing this information. Subsection 315H(3) also imposes a confidentiality
obligation on people who obtain information and documents. This would include
protection of information and documents in line with Australian Government
policies and procedures and only disclosing the information or documents for
the purposes of section 315H or where otherwise provided for under other
legislation.[269]
Protection of personal information
In addition to safeguards directed to the protection of
commercially sensitive information, the broader legislative framework within
which the Bill will operate may provide some protection to personal information
that may be contained in information or a document obtained under proposed
sections 314A-314D, 315C and 315H. In particular, the Explanatory
Memorandum notes that Australian Government agencies subject to the Privacy
Act 1988 are required to protect, use, disclose and destroy personal
information in line with the requirements of that Act. Accordingly, the
Explanatory Memorandum states that information or documents proposed to be
shared in accordance with the requirements of proposed section 315H
would ‘therefore generally be de-identified prior to being shared to remove
personal information’ except where ‘information about a particular person needs
to be shared for the purposes of security’ (such as where information about an
individual is directly relevant to a security threat).[270]
The complaints, investigation and enforcement mechanisms under the Privacy
Act would be available in relation to disclosures that contravened the
requirements of that Act.[271]
It is also worth noting that some Commonwealth agencies
that are not subject to the requirements of the Privacy Act, such as
intelligence agencies, are required to comply with administrative privacy rules
or other administrative guidelines for the protection of personal privacy, which
may offer some protections in for the use and handling of any personal
information disclosed in accordance with proposed section 315H.[272]
Intelligence agencies’ compliance with applicable administrative rules or
guidelines is subject to the independent oversight of the Inspector-General of
Intelligence and Security (IGIS) under the Inspector-General of Intelligence
and Security Act 1986.
Safeguards in relation to secondary disclosures made
for the purposes of security
Where information or a document obtained under proposed
sections 314A-314D and 315C is shared with another person under proposed
subsection 315H(1) for the purposes specified in proposed paragraphs
315H(1)(a) or (b), that provision appears to authorise the recipient to
engage in subsequent (secondary) disclosures of that information for one or
both of the purposes specified in proposed paragraphs 315H(1)(a) and (b).
The Explanatory Memorandum states that proposed paragraph 315H(1)(b)
would ‘potentially authorise sharing of information or documents with state
authorities or international partners, pursuant to the ASIO Act and formal
information sharing arrangements with those countries’ (emphasis added).[273]
As discussed below, however, proposed subsection 315H(1) would appear to
allow secondary disclosures for the purpose of proposed paragraph 315H(1)(b)
in a broader range of circumstances.
If ASIO proposes to engage in a secondary disclosure of
information or documents ‘for the purposes of security’ under proposed paragraph
315H(1)(b), any such disclosure will be governed by the existing
requirements contained in, or made under, the Australian Security
Intelligence Organisation Act 1979 (ASIO Act) that authorise ASIO to
communicate information obtained in the performance of its functions.[274]
Significantly, these requirements include the authorisation or approval of
persons to communicate information, and a requirement for the prior Ministerial
approval of authorities of other countries to which ASIO may communicate
information.[275]
The ASIO Act contains criminal offences for the unauthorised
communication of information.[276]ASIO’s
compliance with the relevant statutory requirements, and supporting internal
administrative guidelines, is also subject to the independent oversight of the
IGIS.[277]
However, proposed subsection 315H(1) appears to
allow a wider range of persons and agencies than ASIO to engage in secondary
disclosures of information to other persons for the purposes specified in proposed paragraphs
315H(1)(a) and (b).
It is not clear whether there are any statutory or
administrative safeguards in existence that would ensure a purported secondary
disclosure of information or documents under proposed paragraph 315H(1)(b)
was, in fact, rationally connected to, and necessary for, the purposes of
security. It might be questioned whether every person or agency to which
information is disclosed under proposed subsection 315H(1) would have
the capacity to accurately assess this matter, or to assess the potential
security implications of a secondary disclosure to a particular recipient or
recipients.
Consideration might therefore be given to placing some
further limitations on secondary disclosures of information or documents under proposed
subsection 315H(1). This might be achieved in a variety of ways, such as:
limiting the persons or agencies that can engage in secondary disclosures;
limiting the range of persons or agencies to which secondary disclosures can be
made; or making provision for administrative limitations, such as authorising
the primary discloser of the information or documents to impose conditions or
limitations on secondary disclosures in individual cases; or imposing
requirements for the prior approval of certain proposed secondary disclosures
(or proposed secondary disclosures to certain recipients).
Consequences for contravening the limitations on
disclosure in proposed section 315H
Although the Bill does not propose to create any specific
sanctions for contravening the limitations on disclosure in proposed
subsections 315H(1) and 315H(2) or the confidentiality obligation in proposed
subsection 315H(3), a number of criminal and administrative sanctions may
apply under existing legislation. For example, the Explanatory Memorandum
notes:
[D]isciplinary action would be available
under existing legislation for Australian Government employees who breach these
provisions. Under the Public Service Act 1999 Australian Public Service
employees must comply with all applicable Australian laws and could face disciplinary
action for any breaches. Section 70 of the Crimes Act 1914 applies
criminal sanctions to unauthorised disclosure of information by current or
former Commonwealth officers. Many Australian state and territories have
similar offences for unauthorised disclosure of information by public officials.[278]
Noting that proposed section 315F allows the
Attorney-General to retain documents and copies provided under proposed
section 315C, the confidentiality of documents retained under the section would
also be protected under existing legislative requirements that govern the use
and disclosure of documents and information held for official purposes,
including secrecy obligations and storage requirements under the Archives
Act 1983.[279]
Viewed as a whole, the existing legislative obligations
placed on Commonwealth officers, including criminal offences and administrative
sanctions for contravention, would appear to operate with proposed subsection
315H(3) as an effective deterrent against unauthorised disclosure. However,
as outlined below, some stakeholders have raised concerns about the scope of
the disclosures capable of being authorised under proposed section 315H.
Criticisms of the information gathering and sharing powers
Concern about the definition of ‘identifying
information’
Proposed subsection 315H(4) defines ‘identifying
information’ for the purpose of information or documents obtained under proposed
sections 314A, 314B, 314C, 314D and 315C as ‘information that
identifies the carrier, carriage service provider or carriage service
intermediary concerned’. As such, it does not apply to information that would
identify individuals.
The OAIC recommended that this definition be amended to include
‘personal information’ within the meaning of that term in the Privacy Act,
so that the limitation on disclosures to non-Commonwealth officers in proposed subsection
315H(2) would also apply to personal information.[280]
However, Australian Government agencies subject to the Privacy
Act are required to protect, use, disclose and destroy personal information
in line with the requirements of that Act. Noting that proposed section 315H
‘is intended to allow information to be shared for reasons of providing threat
information and intelligence to foreign partners in support of reciprocal
information sharing arrangements’, nonetheless:
Information or documents would therefore generally be
de-identified prior to being shared to remove personal information, unless information
about a particular person needs to be shared for the purposes of security (such
as where information about an individual is directly relevant to a security
threat).[281]
The Government also notes that ‘the restrictions in
section 315H will not override existing legislative provisions that authorise
ASIO to communicate information obtained in the performance of its functions’
and:
Parliament has already set out the circumstances in which it
is considered appropriate for an agency such as ASIO to be able to communicate
information collected as part of the performance of its functions, including
personal and other information collected under warrant.[282]
If the recommendation of the
OAIC to expand the definition of ‘identifying information’ in proposed
subsection 315H(4) to include ‘personal information’ as defined in the Privacy
Act were followed, there may be a risk the amendment would frustrate the
intention that information (including personal information in some
circumstances) should be shared with Australia’s foreign partners, including
information in which an individual is identified where the information about
that individual is directly relevant to a security threat.[283]
As such, implementation of the OAIC’s recommendation would require proposed subsection
315H(2) to contain an exemption for disclosures of personal information in
such circumstances.
Concerns about information-gathering powers
Vodafone expressed concern that the ‘sweeping’ information-gathering
powers could be used to obtain information or documents from service providers ‘which
could include documents that may contain commercially or personally sensitive
information only some of which that may relate to matters specific to a
security assessment’.[284]
TPG also expressed concerns about the information-gathering powers, describing
them as ‘very wide’ and stated that they amounted to a power to ‘require the
Telco to go on a fishing-expedition to establish compliance’ with the security
obligations.[285]
Telstra noted that ‘there are no limits on the scope of
information that may be required’ and therefore compliance with a requirement
to provide information or documents ‘may be time consuming, costly and
difficult’ as a carrier or CSP is essentially required to comply with ‘an
open-ended request for information’ that may involve ‘many potential sources of
information’.[286]
Concerns about information-sharing powers
Despite the confidentiality obligation imposed by proposed
subsection 315H(3) and the existing legislative obligations placed on
Commonwealth officers and criminal offences related to the unauthorised disclosure
of confidential information, Vodafone argued that the information-sharing power
‘is still too broad in the capability to demand and distribute commercially
sensitive information’.[287]
Similarly, Telstra recommended that the definition of
‘identifying information’ in proposed subsection 315H(4) should be
expanded to cover any information that could identify the carrier or CSP
‘including in combination with other reasonably accessible information.’[288]
Whilst acknowledging the introduction of a requirement to
de-identify information acquired under proposed section 315C before
disclosing it to a person other than a Commonwealth officer, Telstra argued
that the process still posed:
... a real risk that a person with industry knowledge would be
able to connect the remaining information to the relevant C/CSP. This is of
particular concern when the disclosure is to a private third party who may,
either now or in the future, work for Telstra's commercial competitors.[289]
Telstra recommended that before disclosing any information
to a person other than a Commonwealth officer that the Secretary should be
required to provide the relevant carrier or CSP ‘with a copy of the information
proposed to be disclosed’ and to then ‘consider in good faith’ any of the
carrier’s or CSP’s comments and objections ‘including suggestions about how the
information could be better de-identified’.[290]
The Explanatory Memorandum notes that carriers and CSPs
will not be informed of proposed disclosures of information under proposed
section 315H because this could ‘potentially compromise national security by
identifying the types of issues considered by security agencies and the nature
of sharing arrangements’.[291]
Reporting and oversight
Proposed section 315J requires the Secretary to
provide an annual report to the Attorney-General on the operation of the Bill
as soon as practicable after the end of the relevant financial year. Proposed
subsection 315J(3) requires the Attorney-General to cause the tabling of a
copy of the report in each House of the Parliament within 15 sitting days of
that House after receiving the report.
Item 3 of the Bill prevents duplication of
reporting and oversight by providing that the ACMA is not required to monitor
or report to the Communications Minister on the operation of the Bill’s
provisions as part of its annual reporting obligations in relation to the Act. Item
3 inserts proposed paragraph 105(5B) which provides that the ACMA’s
reporting obligation in paragraph 105(5A)(a) of the Act does not apply in
relation to Part 14 of the Act to the extent that it has been amended by this
Bill (if enacted).
The PJCIS has recommended that the Bill be amended to
specify what should be included in the annual report including:
- the
number of occasions the information-gathering powers have been exercised
- the
number of notificaitons and security capability plans received
-
regulatory performance measures, including the average response
timeframes of the CAC to notifications and the proportion of responses made
within the statutory timeframes
- details
of the Government’s information-sharing arrangements with industry
- a
summary of any feedback or complaints received from stakeholders and
- the
number of occasions the directions-power have been exercised.
Concluding comments
The overall objectives and approach of the Bill appear to
be largely consistent with previous consideration of security of the
telecommunications sector by the PJCIS and Government responses to that
committee’s recommendations. Although stakeholders have expressed concerns that
the regime favours security considerations over commercial or competition
concerns, it appears that the Government has determined that security
considerations should be given priority while seeking to ensure that completion
and cost issues are considered in decision making processes.
The Bill’s reporting mechanism in proposed section 315J
may enable Parliament and interested stakeholders to monitor and evaluate the
operation of the proposed regime over time and assess whether an appropriate
balance is struck in practice.
[1]. Attorney-General’s
Department (AGD), Telecommunications
sector security guidelines: knowing your legislative obligations to protect
telecommunications networks and facilities form unauthorised access and
interference: draft version, AGD, Canberra, November 2015, p. 37.
[2]. For
further information including a flowchart of the administration of the TSSR,
see ibid., p. 37.
[3]. Explanatory
Memorandum, Telecommunications and Other Legislation Amendment Bill 2016,
pp. 2, 4.
[4]. Ibid.,
pp. 4–5.
[5]. In
May 2012, the then Attorney-General Nicola Roxon, referred potential TSSR
measures to the PJCIS for inquiry during the 43rd Parliament and in particular,
sought the PJCIS’s views on whether a regulatory response was necessary or appropriate
and, if so, the appropriate structure of the regulatory model. As part of this
process, the Government issued a discussion paper See: AGD, Equipping
Australia against emerging and evolving threats, AGD, Canberra, July
2012, pp. 29–39.
[6]. Parliamentary
Joint Committee on Intelligence and Security (PJCIS), Report
of the inquiry into potential reforms of Australia’s national security
legislation, PJCIS, Canberra, May 2013, pp. xxviii–xxix.
[7]. Ibid.,
p. xxix.
[8]. Australian
Government, Australian
Government response to chapters 2 and 3 of the Parliamentary Joint Committee on
Intelligence and Security's report of the inquiry into potential reforms of
Australia's national security legislation, Australian Government, July
2015, p. 13.
[9]. G
Brandis (Attorney-General) and M Turnbull (Minister for Communications), Consultation
opens on reforms to strengthen the security of Australia's telecommunications
networks, joint media release, 26 June 2015; and G Brandis
(Attorney-General) and M Fifield (Minister for Communications and the Arts), Further
consultation on telecommunications sector security reform, joint media
release, 27 November 2015. Non-confidential submissions on the two exposure
drafts are published at AGD, ‘Telecommunications security’,
AGD website. A summary of changes made to the Bill in response to stakeholder
feedback on exposure drafts are published at AGD, ‘Telecommunications sector security
reforms’, AGD website, n.d.
[10]. AGD,
‘Telecommunications
security’, AGD website.
[11]. Office
of Best Practice Regulation, Department of the Prime Minister and Cabinet
(DPMC), Telecommunications
sector security reforms: regulatory impact statement, DPMC website, 6
July 2015. (The RIS also indicates that targeted consultations were held with
C/CSPs in 2012, 2014 and 2015: RIS, Attachment B, p. 44.)
[12]. Explanatory
Memorandum, Telecommunications and Other Legislation Amendment Bill 2016,
pp. 50–103.
[13]. PJCIS,
Advisory
report on the Telecommunications (Interception and Access) Amendment (Data
Retention) Bill 2014, PJCIS, Canberra, 27 February 2015,
recommendation 36. (While the formal language used in the recommendation—that
the government should enact legislation—is a non sequitur, the
Committee’s supporting justification at p. 297 makes clear its intention that
the TSSR framework should be implemented before the end of the implementation
phase for data retention. Hence, it appears that the PJCIS was of the view that
the government should introduce a Bill in sufficient time for its passage and
commencement prior to the end of the implementation phase for data retention.)
[14]. Telecommunications
(Interception and Access) Act 1979, subsection 187H(2).
[15]. PJCIS,
Advisory
report on the Telecommunications (Interception and Access) Amendment (Data
Retention) Bill 2014, op. cit., p. 297.
[16]. Ibid.,
p. 298.
[17]. G
Brandis (Attorney-General) and M Turnbull (Minister for Communications), Government
response to committee report on the Telecommunications (Interception and
Access) Amendment (Data Retention) Bill 2014, joint media release, 3
March 2015.
[18]. A
Sheehan (Assistant Secretary, Communications Security Branch, National Security
Division of the AGD), Evidence to PJCIS, Review
of the Telecommunications and Other Legislation Amendment Bill 2016, 16
February 2017, p. 5.
[19]. Explanatory
Memorandum, Telecommunications and Other Legislation Amendment Bill 2016,
pp. 23–24: ‘While the security obligation will have immediate effect from
the expiry date of the implementation period, existing networks and facilities
in place at the time the security obligation comes into effect that are
non-compliant will not be subject to civil penalties for non-compliance with
the security obligation to protect networks and facilities under subsections
313(1A) and (2A). C/CSPs are not expected to retrofit all systems on
commencement of this security obligation. However, there may be very rare cases
where a significant security vulnerability is found in an existing system that
could facilitate acts of espionage, sabotage and foreign interference. In such
cases, government agencies will seek to work with the provider to develop cost
effective solutions to better manage the risks posed by the existing
vulnerability. Subject to how serious the security risk is and how willing the
C/CSP is to collaborate with government to manage the risk, the
Attorney-General could issue a direction requiring mitigation measures to be
implemented’.
[20]. Department
of Prime Minister and Cabinet (DPMC), Australia's
cyber security strategy: enabling innovation, growth and prosperity, DPMC,
Canberra, 21 April 2016, p. 29.
[21]. Parliamentary
Joint Committee on Intelligence and Security (PJCIS), Advisory
report on the Telecommunications and Other Legislation Amendment Bill 2016,
PJCIS, Canberra, June 2017, p.25.
[22]. Senate
Standing Committee for the Selection of Bills, Report,
10, 2016, The Senate, Canberra, 1 December 2016, p. 3.
[23]. Senate
Standing Committee for the Scrutiny of Bills, Alert
digest, 9, 2016, The Senate, Canberra, 23 November 2016, p. 13.
[24]. AGD,
Equipping
Australia against emerging and evolving threats, Commonwealth of
Australia, Canberra, July 2012, pp. 29–39. See also: Parliamentary Joint
Committee on Intelligence and Security (PJCIS), Report
of the inquiry into potential reforms of Australia’s national security
legislation, op. cit.
[25]. PJCIS,
Report
of the inquiry into potential reforms of Australia’s national security
legislation, op. cit., pp. 82–84, recommendation 19.
[26]. PJCIS,
Advisory
report on the Telecommunications (Interception and Access) Amendment (Data
Retention) Bill 2014, op. cit., recommendation 36.
[27]. Senate
Standing Committee on Legal and Constitutional Affairs, Report
on the comprehensive revision of the Telecommunications (Interception and
Access) Act 1979, The Senate, Canberra, March 2015, p. 94.
[28]. S
Martin, ‘ALP
urges fresh draft of telco security laws’, The Australian, 12 August
2015, p. 6.
[29]. M
Clarke and C Uhlmann, ‘Telcos
draw the line at latest Federal Government changes to national security laws’,
ABC News, 22 July 2015.
[30]. PJCIS,
Report
of the inquiry into potential reforms of Australia’s national security
legislation, op. cit., recommendation 19. See also: pp. 84–86:
‘Although there are currently indirect incentives for service providers to
protect their customers’ information (such as public relations damage),
commercial interests will not always align with the national interest. To
account for those instances where advice is not acted upon and where national
security is threatened, the Committee agrees that Government should create a
scheme including the capacity for Government to direct service providers to
take certain remediation actions. The Committee believes there cannot be an
effective and equitable security regime without enforcement mechanisms ... an
infrastructure and information security regime should be introduced whether or
not Government chooses to introduce a data retention regime’.
[31]. The
submissions can be accessed from: AGD, ‘Telecommunications
security’, AGD website, n.d.
[32]. AGG,
‘Telecommunications sector
security reforms’, AGD website, n.d.
[33]. Ibid.
[34]. Australian
Industry Group (AiGroup), Australian Information Industry Association (AIIA),
Australian Mobile Telecommunications Association (AMTA) and Communications
Alliance (Associations), Submission
to PJCIS, Review of the Telecommunications and Other Legislation Amendment
Bill 2016, 3 February 2016. The Associations also made a submission to the
AGD’s consultation process regarding the Exposure Draft: Associations, Joint
submission to AGD, Second exposure draft of the
Telecommunications and Other Legislation Amendment Bill 2015, January
2016.
[35]. Associations,
Submission
to PJCIS, Review of the Telecommunications and Other Legislation Amendment
Bill 2016, 3 February 2016, p. 6.
[36]. Ibid.,
p. 6.
[37]. Ibid.,
pp. 6–7.
[38]. Ibid.,
p. 7.
[39]. Ibid.,
p. 7.
[40]. Associations,
Submission
to PJCIS, Review of the Telecommunications and Other Legislation Amendment
Bill 2016, February 2016, p. 5.
[41]. AGD,
Submission
to PJCIS, Review of the Telecommunications and Other Legislation Amendment
Bill 2016, op. cit., p. 6.
[42]. Ibid.
[43]. Ibid.,
p. 10.
[44]. Ibid.,
p. 10.
[45]. Ibid.,
p. 11.
[46]. Ibid.,
p. 11.
[47]. Ibid.,
p. 7.
[48]. Australian
Centre for Cyber Security (ACCS), Submission
to PJCIS, Review of the Telecommunications and Other Legislation Amendment
Bill 2016, 3 February 2016, p. 2.
[49]. Ibid.,
p. 3.
[50]. Ibid.,
p. 3. A 5-tuple refers to a set of five different values that comprise a
Transmission Control Protocol/Internet Protocol (TCIP/IP) connection. It
includes a source IP address/port number, destination IP address/port number
and the protocol in use. System and network administrators (NA) use 5-tuples to
identify key requirements for creating a secure, operational and bidirectional
network connection between two or more remote and local machines: Techopedia, ‘5-tuple: definition:
what does 5-tuple mean?’, Techopedia website, n.d.
[51]. ACCS,
Submission
to PJCIS, Review of the Telecommunications and Other Legislation Amendment
Bill 2016, 3 February 2016, pp. 2–3.
[52]. Ibid.,
p. 4.
[53]. Ibid.
[54]. Ibid.
[55]. Ibid.
[56]. Ibid.,
p. 5.
[57]. Ibid.
[58]. Ibid.,
p. 6.
[59]. Ibid.,
p. 6.
[60]. Explanatory
Memorandum, Telecommunications and Other Legislation Amendment Bill 2016, p. 7.
[61]. Explanatory
Memorandum, Telecommunications and Other Legislation Amendment Bill 2016, pp.
79–82. See also: AGD, Submission
to PJCIS, Review of the Telecommunications and Other Legislation Amendment
Bill 2016, op. cit., p. 8.
[62]. The
Statement of Compatibility with Human Rights can be found at page 8 of the
Explanatory Memorandum to the Bill.
[63]. Parliamentary
Joint Committee on Human Rights (PJCHR), Report,
9, 2016, Canberra, 22 November 2016, p. 39.
[64]. Explanatory
Memorandum, Telecommunications and Other Legislation Amendment Bill 2016, pp.
7, 23, 25, 27 and 33.
[65]. Attorney-General’s
Department (AGD), ‘Telecommunications
Sector Security Guidelines: draft version’, AGD website, November 2015.
[66]. PJCIS,
Advisory report on the Telecommunications and Other Legislation Amendment
Bill 2016, 30 June 2017, p.41, paragraph [3.49].
[67]. Ibid.,
p. 154, paragraph [5.13].
[68]. Ibid.,
p. 4.
[69]. Ibid.,
p. 4.
[70]. Ibid.,
p. 4.
[71]. Associations,
Submission
to PJCIS, Review of the Telecommunications and Other Legislation Amendment
Bill 2016, 3 February 2016, p. 15.
[72]. Ibid.,
p. 16.
[73]. Ibid.
[74]. Ibid.
[75]. Explanatory
Memorandum, Telecommunications and Other Legislation Amendment Bill 2016,
p. 22.
[76]. Ibid.,
p. 22.
[77]. Ibid.,
p. 23.
[78]. Ibid.,
p. 24.
[79]. Ibid.
[80]. Ibid.,
p. 24.
[81]. Ibid.,
pp. 24–25.
[82]. See
for example: M Stanton (CEO, Communications Alliance), Evidence
to PJICS, Inquiry into Telecommunications and Other Legislation Amendment
Bill 2016, 16 February 2017, p. 10: ‘It is the case that increasing the
core carriage services while they provide an underlay is only part of the mix
that consumers are looking for, be they messaging apps, be they non-carrier
based email—any one of hundreds of over-the-top services that form part of the
bouquet for Australian providers. There is uncertainty around what obligations
you have to protect or to guard against any risk to something that is a
value-add that you do not own or control’ and : C Gillespie-Jones (Director,
Program Management, Communications Alliance), Evidence
to PJICS, Inquiry into Telecommunications and Other Legislation Amendment
Bill 2016, 16 February 2017, p. 10: ‘At the moment, I would say that
unfortunately there is not too much uncertainty about it. If you are providing
an over-the-top service and you are reselling it as an Australian carriage
service provider, you would be bound by TSSR obligations. If, as a consumer,
you were to buy the same service from a non-Australian over-the-top
provider—exactly the same service just not rebranded with a different
Australian brand—then the obligations would not apply ... One is bound by the
obligations; the other one is not. That, as such, is not a desirable outcome
for competition, because it does mean the Australian providers that offer these
over-the-top services are disadvantaged over other non-Australian providers’.
[83]. Ibid.,
p. 108; AGD, Telecommunications
sector security guidelines, Draft version, AGD, Canberra, November
2015.
[84]. Explanatory
Memorandum, Telecommunications and Other Legislation Amendment Bill 2016,
p. 2.
[85]. Ibid.
[86]. Ibid.,
p. 3.
[87]. Australian Security
Intelligence Organisation Act 1979, section 4.
[88]. Defined
as an offence against Subdivision A of Division 72 or Part 5.3 of the Criminal Code Act
1995.
[89]. These
deal with foreign incursions and recruitment, hostage-taking offences, various
ship and fixed-platform related offence (such as seizing a ship or fixed
platform, damaging a ship or fixed platform, or giving false information that
will endanger a ship) and various offences related to aircraft (for example,
hijacking or endangering the safety of aircraft in flight).
[90]. Various
offences in relation to internationally protected persons (for examples,
diplomats) include murder, kidnapping and damaging official premises (for
example, an embassy).
[91]. Explanatory
Memorandum, Telecommunications and Other Legislation Amendment Bill 2016,
p. 22.
[92]. Associations,
Submission
to PJCIS, Review of the Telecommunications and Other Legislation Amendment
Bill 2016, 3 February 2016, pp. 13–14.
[93]. Telecommunications
Act 1997, sections 7, 16, 56 and 86.
[94]. Telecommunications
Act 1997, sections 7 and 16.
[95]. Telecommunications
Act 1997, subsection 87(5).
[96]. See
also the amendment to section 311 of the Act proposed by item 5 of the
Bill.
[97]. Proposed
subsection 313(1A).
[98]. Proposed
subsection 313(1A).
[99]. Under
section 570 of the Telecommunications Act the pecuniary penalties for
contraventions of civil penalty provisions (which would include the security
obligation) provide that the maximum amount that could be payable would be $10m
for a body corporate and $50 000 for a natural person: Explanatory
Memorandum, Telecommunications and Other Legislation Amendment Bill 2016,
pp. 17, 31, 34, 46, and 54.
[100]. Under
proposed sections 315A and 315B.
[101]. Section
68 of the Telecommunications Act provides that a carrier or person must
comply with the conditions of its carrier licence – which includes compliance
with the Telecommunications Act, TIA Act and other legislation.
Schedule 1, section 1 of the Telecommunications Act also provides that a
carrier must comply with the Telecommunications Act 1997, the Telecommunications
(Consumer Protection and Service Standards) Act 1999 and regulations under
that Act and Chapter 5 of the Telecommunications (Interception and Access)
Act 1979. In turn section 570 of the Telecommunications Act sets out the
pecuniary penalties for contravention of the civil penalty provisions and Part
1 of Schedule 1 of the Telecommunications Act provides that a standard
conditions of a carrier licence includes compliance with the Telecommunications
Act, TIA Act and other legislation. Collectively this ensures that failure to
comply with the security obligation, the information gathering powers or a
direction would result potentially significant civil penalties being imposed.
[102]. Proposed
subsection 313(1B).
[103]. Proposed
subsection 313(1B).
[104]. Proposed
subsection 313(2B).
[105]. Subsection
87(5) of the Telecommunications Act 1997 provides that an entity who
receives a reward for arranging the supply of a listed carriage service by a carriage
service provider to a third person who would be a carriage service provider if
the person had supplied that carriage service and who has a commercial
relationship with the third person which is governed by an agreement relating
to the continuing supply of the service.
[106]. As
noted by the Australian Communications and Media Authority (AMCA) subsection
87(5) of the Telecommunications Act 1997 is ‘intended to capture
switchless resellers and/or aggregators who may not themselves be supplying a
listed carriage service’: ACMA, ‘Service
provider obligations’, ACMA website, 7 November 2016.
[107]. Explanatory
Memorandum, Telecommunications and Other Legislation Amendment Bill 2016, p.
22.
[108]. Ibid.,
p. 23.
[109]. Ibid.,
p. 25.
[110]. Ibid.,
p. 23.
[111]. Ibid.,
p. 26.
[112]. Ibid.,
p. 26.
[113]. Ibid.,
p. 23.
[114]. Explanatory
Memorandum, Telecommunications and Other Legislation Amendment Bill 2016, p.
24.
[115]. Ibid.
[116]. Ibid.,
pp. 24-25.
[117]. Ibid.,
p. 23.
[118]. Ibid.,
[119]. AGD,
Telecommunications
sector security guidelines, op. cit., p. 15.
[120]. Ibid.,
p. 15.
[121]. Ibid.,
pp. 15–22.
[122]. Optus,
Submission
to AGD, Second exposure draft of the Telecommunications and Other
Legislation Amendment Bill 2015, 14 January 2016, p. 2.
[123]. Proposed
subsection 313(1A).
[124]. Proposed
subsection 313(2).
[125]. Associations,
Submission
to PJCIS, Review of the Telecommunications and Other Legislation Amendment
Bill 2016, 3 February 2017, p. 13.
[126]. Ibid.,
p. 16.
[127]. Ibid.,
p. 17.
[128]. Ibid.,
p. 17.
[129]. Law
Council of Australia (LCA), Submission
to AGD, Second exposure draft of the Telecommunications and Other
Legislation Amendment Bill 2015, 18 January 2016, p. 4.
[130]. Ibid.,
p. 4.
[131]. Optus,
Submission
to AGD, Second exposure draft of the Telecommunications and Other
Legislation Amendment Bill 2015, op. cit., p. 1.
[132]. Ibid.,
p. 1.
[133]. Foxtel,
Submission
to PJCIS, Review of the Telecommunications and Other Legislation Amendment
Bill 2016, 3 February 2016, p. 2. Foxtel made a similar point in
its submission regarding the ED: Foxtel, Submission
to AGD, Second exposure draft of the Telecommunications and Other Legislation
Amendment Bill 2015, 19 January 2016, p. 2.
[134]. Foxtel,
Submission
to PJCIS, Review of the Telecommunications and Other Legislation Amendment
Bill 2016, op. cit., p. 2. Foxtel made a similar point in its submission
regarding the ED, stating: it’s not clear whether its broadcasting and content
infrastructure and facilities will also be subject to the new protection
obligations’: Foxtel, Submission
to AGD, Second exposure draft of the Telecommunications and Other
Legislation Amendment Bill 2015, op. cit., p. 2.
[135]. Foxtel,
Submission
to PJCIS, Review of the Telecommunications and Other Legislation Amendment
Bill 2016, op. cit., pp. 3–4; Foxtel, Submission
to AGD, Second exposure draft of the Telecommunications and Other Legislation
Amendment Bill 2015, op. cit., p. 4.
[136]. Foxtel,
Submission
to PJCIS, Review of the Telecommunications and Other Legislation Amendment
Bill 2016, op. cit., p. 4; Foxtel, Submission
to AGD, Second exposure draft of the Telecommunications and Other
Legislation Amendment Bill 2015, op. cit., pp. 3–4.
[137]. Foxtel,
Submission
to PJCIS, Review of the Telecommunications and Other Legislation Amendment
Bill 2016, op. cit., p. 4.
[138]. AGD,
Submission
to PJCIS, Review of the Telecommunications and Other Legislation Amendment
Bill 2016, submission no. 4, 3 February 2016, p. 15.
[139]. Ibid.,
p. 16.
[140]. PJCIS,
Advisory report, op.cit, p.42.
[141]. Associations,
Submission
to PJCIS, Review of the Telecommunications and Other Legislation Amendment
Bill 2016, op. cit., pp. 3, 18; Macquarie Telecom, Submission
to PJCIS, Review of the Telecommunications and Other Legislation Amendment
Bill 2016, submission no. 2, February 2016, p. 3.
[142]. Associations,
Submission
to PJCIS, Review of the Telecommunications and Other Legislation Amendment
Bill 2016, op. cit., p. 18.
[143]. Ibid.,
p. 3.
[144]. Ibid.,
p. 18.
[145]. Explanatory
Memorandum, Telecommunications and Other Legislation Amendment Bill 2016, p.
24.
[146]. AGD,
‘Interception
capability plans’, AGD website, n.d.; Under section 6R of the Telecommunications
(Interception and Access) Act 1979 (TIA Act), the CAC is the
Secretary of the Department (AGD) or a person specified in a legislative
instrument by the Minister to be the CAC. Under the TIA Act the CAC has
various powers related to authorisations, consultation with ACMA, the
Information Commissioner, declaring the application of various parts of the TIA
Act to carriers, and service providers, approving and amending data
retention implementation plans, granting exemptions from certain the
obligations imposed on service providers or carriers by the TIA Act: see
for example sections 183, 187B, 187E, 187F, 187G, 187H, 187J, 187K, 187KA, 192,
196, 197 of the TIA Act.
[147]. Proposed
subsections 314A(4)–(7).
[148]. Section
276 of the Telecommunications Act 1997 contains an offence for the
unauthorised disclosure and use of certain information. This includes
information that ‘relates to’ the contents or substance of a communication that
has been carried by a C/CSP; carriage services supplied or intended to be
supplied to another person; and the affairs or personal particulars (including
any unlisted telephone number or any address) of another person (and hence
included metadata as it ‘relates to’ the content of communications).
[149]. Explanatory
Memorandum, Telecommunications and Other Legislation Amendment Bill 2016, p.
28.
[150]. Ibid.,
p. 29.
[151]. Ibid.,
pp. 29–30.
[152]. Explanatory
Memorandum, Telecommunications and Other Legislation Amendment Bill 2016, p.
28.
[153]. AGD,
‘Telecommunications
Sector Security Guidelines (Draft version)’, op. cit., p. 27.
[154]. Ibid.
[155]. Ibid.
[156]. AGD,
Telecommunications
sector security guidelines (draft version), op. cit., pp. 25–26.
[157]. PJIC
Advisory report, op.cit. p.57.
[158]. Proposed
subsection 314D(2).
[159]. Explanatory
Memorandum, Telecommunications and Other Legislation Amendment Bill 2016, pp.
31–32.
[160]. AGD,
Telecommunications
sector security guidelines, op. cit., p. 31.
[161]. Ibid.
[162]. Ibid.
[163]. Ibid.,
pp. 31–32.
[164]. Ibid.,
p. 32.
[165]. Ibid.
[166]. Ibid.
[167]. Ibid.
[168]. Explanatory
Memorandum, Telecommunications and Other Legislation Amendment Bill 2016, p.
32.
[169]. Ibid.
[170]. Ibid.,
p. 34.
[171]. Proposed
subsections 314B(1) and 314D(1).
[172]. Proposed
subsections 314B(2) and 314D(2).
[173]. Proposed
paragraphs 314B(3)(a) and (b) and proposed paragraphs 314D(3)(a) and
(b).See also the definition of the term ‘security’ in proposed subsections
314B(7) and 314D(7).
[174]. Proposed
paragraphs 314B(3)(c)-(e) and 314D(3)(c)–(e).
[175]. Explanatory
Memorandum, Telecommunications and Other Legislation Amendment Bill 2016, p.
30.
[176]. The
reasons for this are set out at paragraphs [144]–[148] and [161]–[163] of the
Explanatory Memorandum to the Bill.
[177]. Proposed
subsections 314B(5) and 314D(5).
[178]. Proposed
subsections 314B(6) and 314D(6). (Notices issued under proposed
subsection 314D(6) may relate to one or more proposed changes to an SCP.)
[179]. Proposed
paragraphs 314B(6)(b) and 314D(6)(b).
[180]. Associations,
Submission
to PJCIS, Review of the Telecommunications and Other Legislation Amendment
Bill 2016, 3 February 2017, p. 12.
[181]. Ibid.
[182]. Ibid.
[183]. Ibid.
[184]. Ibid.
[185]. Ibid.,
p. 15.
[186]. Ibid.,
p. 15.
[187]. Optus,
Submission
to AGD, Second exposure draft of the Telecommunications and Other
Legislation Amendment Bill 2015, op. cit., p. 3.
[188]. Optus,
Submission
to PJCIS, Review of the Telecommunications and Other Legislation Amendment
Bill 2016, submission no. 1, 3 February 2017, p. 7.
[189]. Ibid.
[190]. Vodafone
Hutchison Australia (Vodafone), Submission
to AGD, Second exposure draft of the Telecommunications and Other
Legislation Amendment Bill 2015, n.d., pp. 3–4.
[191]. TPG
Telecom Limited Group (TPG), Submission
to AGD, Second exposure draft of the Telecommunications and Other
Legislation Amendment Bill 2015, 18 January 2016, p. 2.
[192]. Macquarie
Telecom, Submission
to PJCIS, Review of the Telecommunications and Other Legislation Amendment
Bill 2016, submission no. 2, February 2017, p. 3.
[193]. Ibid.,
p. 4.
[194]. Ibid.,
p. 4.
[195]. Ibid.,
p. 4.
[196]. See,
for example, Associations, Submission
to PJCIS, Review of the Telecommunications and Other Legislation Amendment
Bill 2016, 3 February 2017, pp. 13–14.
[197]. M
Stanton (CEO, Communications Alliance), Evidence
to PJICS, Inquiry into Telecommunications and Other Legislation Amendment
Bill 2016, 16 February 2017, p. 8.
[198]. AGD,
Telecommunications
sector security guidelines, op. cit., p. 30.
[199]. Ibid.,
p. 9.
[200]. Optus,
Submission
to PJCIS, Review of the Telecommunications and Other Legislation Amendment
Bill 2016, op. cit., p. 5.
[201]. Ibid.,
p. 2.
[202]. Ibid.
[203]. Foxtel,
Submission to AGD, Second
exposure draft of the Telecommunications and Other Legislation Amendment Bill
2015, op. cit., p. 2.
[204]. Ibid.,
p. 2; Foxtel, Submission
to PJCIS, Review of the Telecommunications and Other Legislation Amendment
Bill 2016, op. cit., pp. 3–4: ‘Foxtel considers it should be clarified that
where infrastructure and facilities are used solely or principally for the
supply of broadcasting services it is not subject to the proposed reforms ... Foxtel
requests the Committee recommend there be further clarification ... about the
purpose and application of the proposed ... notification requirements ... to
clarify that infrastructure and facilities used solely or principally for
broadcasting or content services are not intended to be subject to this
additional regulation’.
[205]. Ibid.,
pp. 3–4.
[206]. Ibid.,
p. 4.
[207]. Explanatory
Memorandum, Telecommunications and Other Legislation Amendment Bill 2016,
p. 29.
[208]. This
is the Communications Minister: Administrative Arrangements Order, 1 September
2016, p. 9.
[209]. Explanatory
Memorandum, Telecommunications and Other Legislation Amendment Bill 2016,
p. 3.
[210]. Schedule
1, items 27–29.
[211]. Explanatory
Memorandum, Telecommunications and Other Legislation Amendment Bill 2016,
p. 35.
[212]. Ibid.
[213]. Proposed
subsection 315A(3), Explanatory
Memorandum, Telecommunications and Other Legislation Amendment Bill 2016,
p. 35.
[214]. Explanatory
Memorandum, Telecommunications and Other Legislation Amendment Bill 2016,
p. 35.
[215]. Proposed
subsections 315A(4) and (5).
[216]. Explanatory
Memorandum, Telecommunications and Other Legislation Amendment Bill 2016, p.
35.
[217]. Ibid.,
p. 14. See also p. 58.
[218]. ASIO,
ASIO’s
security assessment function, ASIO, Canberra, September 2013, p. 1.
[219]. Ibid.
[220]. Explanatory
Memorandum, Telecommunications and Other Legislation Amendment Bill 2016, p.
36.
[221]. Proposed
paragraphs 351B(1)(a)–(c).
[222]. Proposed
subsections 315B(1) and (3).
[223]. Explanatory
Memorandum, Telecommunications and Other Legislation Amendment Bill 2016,
p. 35; ASIO, ‘Attorney-General’s
guidelines’, n.d.; ASIO, Attorney-General's
guidelines in relation to the performance by the Australian Security
Intelligence Organisation of its function of obtaining, correlating, evaluating
and communicating intelligence relevant to security (including politically
motivated violence), n.d., (made under s 8A of the ASIO Act),
para 4.1(b) at p. 3).
[224]. Explanatory
Memorandum, Telecommunications and Other Legislation Amendment Bill 2016,
pp. 14–15 and p. 36.
[225]. Ibid.,
p. 15.
[226]. Proposed
paragraph 315B(8)(a) and proposed subsection 315B(10).
[227]. Proposed
subparagraphs 315B(8)(b)(i)–(ii) and proposed subsection 315B(9).
[228]. Proposed
subparagraph 351(8)(b)(iii).
[229]. Proposed
subsection 315B(5).
[230]. Explanatory
Memorandum, Telecommunications and Other Legislation Amendment Bill 2016, p.
39.
[231]. Ibid.,
p. 40.
[232]. Ibid.,
p. 39.
[233]. Explanatory
Memorandum, Telecommunications and Other Legislation Amendment Bill 2016, p.
38.
[234]. Ibid.,
p. 39.
[235]. Ibid.,
p. 40.
[236]. TPG,
Submission
to AGD, Second exposure draft of the Telecommunications and Other Legislation
Amendment Bill 2015, op. cit., p. 3.
[237]. Ibid.,
p. 4.
[238]. Vodafone,
Submission
to AGD, Second exposure draft of the Telecommunications and Other Legislation
Amendment Bill 2015, op. cit., p. 3.
[239]. TPG,
Submission
to AGD, Second exposure draft of the Telecommunications and Other Legislation
Amendment Bill 2015, op. cit., p. 4.
[240]. Ibid.
[241]. Optus,
Submission
to AGD, Second exposure draft of the Telecommunications and Other Legislation
Amendment Bill 2015, op. cit., p. 4.
[242]. Ibid.
[243]. Ibid.
[244]. Vodafone,
Submission
to AGD, Second exposure draft of the Telecommunications and Other Legislation
Amendment Bill 2015, op. cit., p. 3.
[245]. Explanatory
Memorandum, Telecommunications and Other Legislation Amendment Bill 2016,
pp. 38–39.
[246]. LCA,
Submission
to AGD, Second exposure draft of the Telecommunications and Other Legislation
Amendment Bill 2015, op. cit., p. 3.
[247]. Ibid.,
p. 3.
[248]. Ibid.,
p. 3.
[249]. Ibid.,
p. 3.
[250]. Explanatory
Memorandum, Telecommunications and Other Legislation Amendment Bill 2016,
p. 35; ASIO, ‘Attorney-General’s
guidelines’, n.d.; ASIO, Attorney-General's
Guidelines in relation to the performance by the Australian Security
Intelligence Organisation of its function of obtaining, correlating, evaluating
and communicating intelligence relevant to security (including politically
motivated violence), n.d., (made under s 8A of the ASIO Act), para
4.1(b) at p. 3).
[251]. Ibid.,
p. 4.
[252]. Ibid.,
p. 4.
[253]. TPG,
Submission
to AGD, Second exposure draft of the Telecommunications and Other
Legislation Amendment Bill 2015, op. cit., p. 4.
[254]. Ibid.
[255]. Explanatory
Memorandum, p. 35.
[256]. Ibid.
[257]. Explanatory
Memorandum, pp. 35–26.
[258]. Proposed
subsections 315C(1) and (2).
[259]. Proposed
section 315G. (The Secretary may delegate certain of his or her
information-gathering powers to the Director-General of Security, by a written
instrument of delegation. In exercising delegated powers, the Director-General
is required under proposed subsection 315C(2) to comply with any directions the
Secretary may issue.)
[260]. Explanatory
Memorandum, Telecommunications and Other Legislation Amendment Bill 2016, p.
42: ‘Non-compliance with a notice to provide information or documents will constitute
a breach of the Telecommunications Act and will attract the operation of the
civil remedies regime in Part 30 (injunctions), Part 31 (civil penalties) and
Part 31A (enforceable undertakings) of the Telecommunications Act. The Bill
authorises the Attorney-General to bring proceedings to enforce these remedies
for non-compliance with a notice issued under section 315C.’
[261]. Telecommunications
Act 1997, Schedule 1, section 1: a carrier must comply with the Telecommunications
Act 1997, the Telecommunications (Consumer Protection and Service
Standards) Act 1999 and Regulations under that Act and Chapter 5 of the Telecommunications
(Interception and Access) Act 1979.
[262]. Ibid.
[263]. Telecommunications
Act 1997, Schedule 2, section 1: a service provide must comply with the Telecommunications
Act 1997, the Telecommunications (Consumer Protection and Service
Standards) Act 1999 and Regulations under that Act and Chapter 5 of the Telecommunications
(Interception and Access) Act 1979.
[264]. Ibid.
[265] ‘Use’
immunity is defined as where a person is required to answer questions which
would tend to incriminate or expose him or herself to a penalty, any
information or evidence given that would tend to incriminate the person may not
be used against him or her directly in court. In comparison, ‘derivative use’
immunity is where any information or evidence given that would tend to
incriminate the person may not be used to gather other evidence against that
person: AGD, A
guide to framing Commonwealth offences, infringement notices and enforcement
powers, AGD, Canberra, September 2011, pp. 97, 98.
[266]. Explanatory
Memorandum, Telecommunications and Other Legislation Amendment Bill 2016,
p. 43.
[267]. ‘Commonwealth
Officer’ is defined in proposed subsection 315H(4) as including (a) a
person who is in the employment of the Commonwealth, other than a person who is
engaged outside Australia to perform duties outside Australia as an employee;
or (b) a person who holds or performs the duties of any office or position
established by or under a law of the Commonwealth; or (c) a member of the
Australian Defence Force; or (d) the Commissioner of the Australian Federal
Police, a Deputy Commissioner of the Australian Federal Police, an AFP 9
employee, a special member or a special protective service officer (all within the
meaning of the Australian Federal Police Act 1979). Importantly, this
includes persons employed by the Director-General of Security, on behalf of the
Commonwealth, under subsection 84(1) of the Australian Security Intelligence
Organisation Act 1979.
[268]. Ibid.
[269]. Explanatory
Memorandum, Telecommunications and Other Legislation Amendment Bill 2016,
pp. 43–44.
[270]. Ibid.,
p. 43, paragraph [210].
[271]. For
a useful summary, see: Office of the Australian Information Commissioner
(OAIC), Guide
to privacy regulatory action, June 2015.
[272]. For a useful summary of privacy rules applied to Australian
Intelligence Community (AIC) agencies, see: Inspector-General of Intelligence
and Security (IGIS), ‘AIC privacy protections’, IGIS website.
[273]. Explanatory
Memorandum, Telecommunications and Other Legislation Amendment Bill 2016,
pp. 43–44.
[274]. See
further: Explanatory
Memorandum, Telecommunications and Other Legislation Amendment Bill 2016,
p. 44.
[275]. ASIO
Act, subsections 18(1) and 18(3)–(4B) (authorisations in relation to the
disclosure of intelligence and other information) and section 19 especially
paragraph 19(1)(c) (cooperation with other entities for the purpose of ASIO
performing its functions, including cooperation and information-sharing with
authorities of other countries approved by the Attorney-General). See further: Explanatory
Memorandum, Telecommunications and Other Legislation Amendment Bill 2016,
p. 44, paragraph [216] which states that ‘in general, the types of foreign
authorities that are approved by the Attorney-General perform broadly similar
functions to ASIO, and include security and intelligence agencies, law
enforcement, immigration and boarder control, and government coordination
bodies’.
[276]. ASIO
Act, subsection 18(2). See also sections 18A and 18B (offences for unauthorised
dealings with records and the unauthorised making of records of information,
which apply to conduct that places information at risk of unauthorised
disclosure that falls short of communication).
[277]. See
further: Explanatory
Memorandum, Telecommunications and Other Legislation Amendment Bill 2016,
p. 44.
[278]. Ibid.,
p.45.
[279]. Ibid.,
p.42.
[280]. OAIC,
Submission
to PJCIS, Review of the Telecommunications and Other Legislation Amendment
Bill 2016, 8 February 2017, pp. 2–3.
[281]. Explanatory
Memorandum, Telecommunications and Other Legislation Amendment Bill 2016, p.
44.
[282]. Ibid.
[283]. Ibid.
[284]. Vodafone,
Submission
to AGD, Second exposure draft of the Telecommunications and Other Legislation
Amendment Bill 2015, op. cit., p. 4.
[285]. TPG,
Submission
to AGD, Second exposure draft of the Telecommunications and Other
Legislation Amendment Bill 2015, op. cit., p. 4.
[286]. Telstra,
Submission
to AGD, Second exposure draft of the Telecommunications and Other Legislation
Amendment Bill 2015, 22 December 2015, p. 5.
[287]. Vodafone,
Submission
to AGD, Second exposure draft of the Telecommunications and Other
Legislation Amendment Bill 2015, op. cit., p. 4.
[288]. Telstra,
Submission
to AGB, Second exposure draft of the Telecommunications and Other
Legislation Amendment Bill 2015, op. cit., p. 5.
[289]. Ibid.
[290]. Ibid.
[291]. Explanatory
Memorandum, Telecommunications and Other Legislation Amendment Bill 2016, p.
44.
For copyright reasons some linked items are only available to members of Parliament.
© Commonwealth of Australia
Creative Commons
With the exception of the Commonwealth Coat of Arms, and to the extent that copyright subsists in a third party, this publication, its logo and front page design are licensed under a Creative Commons Attribution-NonCommercial-NoDerivs 3.0 Australia licence.
In essence, you are free to copy and communicate this work in its current form for all non-commercial purposes, as long as you attribute the work to the author and abide by the other licence terms. The work cannot be adapted or modified in any way. Content from this publication should be attributed in the following way: Author(s), Title of publication, Series Name and No, Publisher, Date.
To the extent that copyright subsists in third party quotes it remains with the original owner and permission may be required to reuse the material.
Inquiries regarding the licence and any use of the publication are welcome to webmanager@aph.gov.au.
Disclaimer: Bills Digests are prepared to support the work of the Australian Parliament. They are produced under time and resource constraints and aim to be available in time for debate in the Chambers. The views expressed in Bills Digests do not reflect an official position of the Australian Parliamentary Library, nor do they constitute professional legal opinion. Bills Digests reflect the relevant legislation as introduced and do not canvass subsequent amendments or developments. Other sources should be consulted to determine the official status of the Bill.
Any concerns or complaints should be directed to the Parliamentary Librarian. Parliamentary Library staff are available to discuss the contents of publications with Senators and Members and their staff. To access this service, clients may contact the author or the Library‘s Central Enquiry Point for referral.