Telstra, telcos fume over new security reforms

Australia's biggest telco and the wider telecommunications industry have lashed out at the federal government over plans to introduce new security laws that represent further legislative burden on the sector.

Late last month the Attorney-General's Department released information on its proposed 'telecommunications security sector reforms', The laws aim to better protect telco infrastrucure and systems from attack, while also giving the government power to intervene when a security risk is identified.

Telcos and internet service providers would be forced to hand over details of network changes and procurement plans or be hit with civil penalties of around $250,000 for non-compliance. 

The government drafted the proposed reforms due to concern about the threat posed by suppliers of equipment and managed services located in foreign countries.

For telcos and ISPs, the costs of compliance is likely to be around $184,000 per organisation annually.

At the time, telco industry body the Communications Alliance said while it was pleased the government was no longer planning to recoup $2 million annually in costs from the industry for the new legislation, it still represented more red tape, additional compliance costs and higher levels of intrusion.

"Whether this is a proportionate response is a question that the parliament will need to consider in consultation with industry," CEO John Stanton said last month.

"The government has indicated that the proposed legislation will not be used as a tool to prohibit specific equipment suppliers from operating in the Australian marketplace and this needs to be assured, given the potential competition impacts of such a move and the potential for overall network costs to be driven upward, to the detriment of industry and consumers."

'Stop being so heavy-handed'

Stanton today went further in his criticism, arguing the powers the goverment was preparing to give itself were too broad and intrusive. 

The draft bill states that telcos and ISPs are required to hand over information on network changes and procurement plans should the AGD decide they could create espionage and sabotage vulnerabilities in networks and systems.

The AGD would not be limited on how long it could retain the information nor who it could pass the documents on to.

"There's no actual requirement to consult with the service provider that's about to be hit by this order and there's no apparent right of appeal against those sorts of decisions."

He said the changes would mean further financial burden for a sector that has had a slew of new obligations heaped onto it since the LNP came to power in 2013.

The proposed security reforms add to the mandatory data retention bill passed in March and the website blocking bill and industry code aimed at tackling copyright infringement.

"It's certainly an expensive period for the telco sector," Stanton said.

"With each of these national security-related initiatives by the government, there seems to be an assumption the telecommunications sector will simply foot the bill for a big chunk of that.

"Ultimately, that's to the disadvantage of the competitiveness of the Australian industry but also to the consumers who are at risk of having to foot some of that bill themselves."

Telstra similarly called on the government to take a step back and consider the impact its ongoing legislative changes were having on the telco industry.

"We share the government’s goal of ensuring Australian telecommunications networks are secure, but the powers as they are proposed are quite broad and potentially impose substantial costs on Australian telcos and our customers," Telstra chief risk officer Kate Hughes said in a statement.

"The reforms should complement private sector investment and expertise in security. We are best placed to manage security issues on our networks, therefore any government intervention should be light touch and principles based.

"We have a clear commercial incentive to maintain the security of our networks and protect our customers’ data, so we have already made significant investments in security and these need to be recognised."

The government is taking submissions on its draft bill until July 31.

New Zealand passed a similar law in late 2013, which gave the country's government the final say in telco network upgrades and new deployments.