In brief

  • A new draft Bill seeks to protect telecommunications networks from unauthorised access and interference in the interests of national security.
  • Under the draft Bill telecommunications carriers and carriage service providers (CSPs) must do their best to protect their networks from unauthorised access and interference, and carriers and nominated CSPs must notify security agencies of key changes to their networks and management systems.
  • Penalties of up to $250,000 have been proposed, as well as the ability to shut down telecommunications services where there is a risk to national security.
  • Submissions are due 31 July 2015.

Increased data protection for telecommunication networks

The storage of online data is more vulnerable to breach than ever before, with increasingly sophisticated cyber attacks posing threats to our national security. The government has identified the resilience of telecommunications infrastructure as crucial in safeguarding Australia from espionage and other harmful activities, and on 26 June 2015 released the Exposure Draft of the Telecommunications and Other Legislation Amendment Bill 2015 (Cth)1 (the DraftBill).

The Draft Bill proposes amendments to the Telecommunications Act 1997 (Cth) (the Act)to protect telecommunications networks from unauthorised access and interference that may pose national security risks. The Draft Bill is intended to complement the recently passed data retention regime as part of the government’s wider counter-terrorism initiatives.

The Draft Bill in more detail

The Draft Bill aims to promote more effective management of data security risks, and implements a regulatory framework that strengthens the requirement for information sharing between government and telecommunications companies. Of particular note is the proposed expansion of section 313 of the Act, requiring carriers and CSPs to do their best to protect their networks from unauthorised access and interference on top of the existing requirement to do their best to prevent their networks and facilities being used to commit offences.

This proposal effectively expands the notification requirement in section 202B of the Interception and Access Act 1979 (Cth) for telecommunications carriers and nominated CSPs; such companies must formally notify security agencies of key changes to their networks and management systems that may affect their ability to protect their networks from unauthorised access and interference. The government is most interested in equipment, services and support arrangements, particularly in outsourcing and offshoring arrangements, as they are considered to be susceptible targets for national security breaches.

The Draft Bill also provides the Secretary of the Attorney-General’s Department (AGD) with regulatory power to issue directions to, and gather information from, carriers and CSPs, enforceable by a Federal Court fine of $250,000 for companies and $50,000 for individuals. Where the national security risk is particularly high the AGD can also shut down a telecommunications service. However, Senator Brandis indicated that these powers would only be exercised as a last resort.

The measures under the Draft Bill will come at a financial cost for the government of approximately $1.6 million annually. The burden of the Draft Bill would also be felt by telecommunications companies, with John Stanton, the chief executive of the Communications Alliance, explaining that “the proposed regime does represent new ‘red-tape’, additional compliance costs for industry and a higher level of intrusion into the commercial operations of the industry”.

Conclusion

The introduction of the Draft Bill, together with the recent implementation of the data retention regime, evinces the government’s clear focus on protecting data and mitigating security risks as a national priority. These initiatives should motivate all companies storing online data to consider how best to protect their information from exposure to cyber attacks. The government is seeking submissions on the Draft Bill until 31 July 2015, and has indicated that the Draft Bill will be introduced into Parliament later in 2015.