Brandis urged to dump telco security reforms

Australia's telecommunications sector is continuing its crusade against the government's proposed industry security reforms, with submissions to the draft legislation revealing universal opposition to the suggested changes.

The Attorney-General's Department released its 'telecommunications sector security reforms' in June. 

The sweeping draft laws would see telcos forced to hand over sensitive information about network changes and procurement plans in order to address national security risks.

It would also allow the government to ban telcos from buying equipment from certain manufacturers like Huawei - which is still barred from contracting to the NBN - over security concerns.

The bill's arrival was immediately followed by swift opposition to the plan, first by Australia's biggest telco Telstra and industry representative body the Communications Alliance, with four other industry representative groups making submissions close behind.

The Attorney-General's Department today published 13 submissions to the exposure draft of the bill, revealing unanimous opposition to the plan.

Telcos such as iiNet, TPG, Optus and Macquarie Telecom lent their voices to the chorus of opposition, while Foxtel and the Office of the Australian Information Commissioner highlighted selected concerns with the draft bill.

iiNet and TPG used strong language to call on the government to abandon the proposed reform due to the burden it would impose on the industry and the "overly broad" powers it would provide the government.

“TPG does not believe te Attorney-General or his secretary is the best placed authority to make decisions about a telco’s network security," TPG wrote [pdf].

"They lack the requisite knowledge of the intricacies of a telco’s systems and are unlikely to possess the skills to determine the appropriate form and level of network security required.”

iiNet labelled the government's plan to give itself power to direct carriers to take certain actions as going "far beyond any measures" currently required to protect Australia's national security interests.

Similarly, the proposal to hit carriers with a new obligation to ensure they "do their best" to protect their networks and infrastructure from unauthorised access or interference was "superfluous" and served no useful purpose, iiNet argued.

"iiNet believes that its intended effect ... goes beyond what is acceptable in a free and democratic society," the ISP wrote [pdf].

Macquarie Telecom said the draft legislation provided for "unjustifiably intrusive powers for government to intervene in telecommunications infrastructure without adequate consultation or protections for industry". [pdf]

"Macquarie Telecom is not persuaded that there are sufficient grounds to warrant the proposed reforms and is very concerned at the prospect of the costs and intrusion into its commercial operations proposed in the legislation."

Telstra [pdf], Foxtel [pdf] and Optus were more muted in their criticism but highlighted many of the same concerns and called for significant changes to the bill.

Optus said the current exposure draft does not provide the "necessary rigour for such a new security assessment to operate practically". 

"Further work is needed to establish clear decision-making criteria before a direction can be issued to providers, and an appeals mechanism for these directions must be made available," Optus wrote [pdf].

The bill does not currently allow for appeals against government directives.

Failure to comply with an AGD directive to hand over the data could see a telco hit with a $250,000 fine. For telcos and ISPs, the costs of compliance is likely to be around $184,000 per organisation annually.

The OAIC raised concerns that the draft bill may confuse carriers who are already required to take all reasonable steps to secure their networks under the Australia Privacy Principles. It called on the government to clarify much of the language in the bill and better align it to privacy law.