Telecommunications (Carriage Service Provider—Security Information) Amendment Determination 2023

Overview

The Telecommunications (Carrier Licence Conditions – Security Information) Amendment Declaration 2023 and the Telecommunications (Carriage Service Provider – Security Information) Amendment Determination 2023 were enacted by the Minister for Communications, Michelle Rowland, under the authority granted by Section 63(1) and Section 63(3) of the Telecommunications Act 1997. These amendments aim to extend the existing conditions and rules for carrier licenses and carriage service providers (CSPs) related to the registration of critical telecommunications assets and mandatory cyber security reporting. The original conditions established in July 2022 are extended for an additional 18 months, with sunset clauses modified to ensure the measures will be in effect for three years from their original implementation. The primary objective of these amendments is to maintain and enhance the security of Australia’s telecommunications infrastructure, ensuring that carrier licence holders and CSPs comply with updated cyber security protocols.

Scope and Application

The Telecommunications (Carrier Licence Conditions – Security Information) Amendment Declaration 2023 and the Telecommunications (Carriage Service Provider – Security Information) Amendment Determination 2023 are legislative instruments made under the authority of the Telecommunications Act 1997. These instruments extend the existing carrier license conditions and service provider rules concerning the register of critical telecommunications assets and mandatory reporting of cybersecurity information, initially established in July 2022. They apply to entities holding a carrier licence and to carriage service providers, specifically targeting the telecommunications industry to ensure the security of critical assets and the effective reporting of cybersecurity incidents. The instruments are effective throughout the Commonwealth of Australia and will remain in force for an additional 18 months, with a sunset clause ensuring they automatically cease operation after a total of three years from their original enactment. The instruments do not apply to any specific exclusions, exemptions, or thresholds as detailed in the explanatory statement, and their operation can be further refined through subordinate instruments if necessary.

Key Provisions

The Telecommunications (Carrier Licence Conditions – Security Information) Amendment Declaration 2023 and the Telecommunications (Carriage Service Provider – Security Information) Amendment Determination 2023 amend existing provisions under the Telecommunications Act 1997 (Tel Act). The instruments extend the existing provisions for a register of critical telecommunications assets and the mandatory reporting of cybersecurity incidents. These provisions, originally established in July 2022, are now extended for an additional 18 months, with an automatic repeal three years from their initial creation (Section 4 of the Schedules of both instruments). These instruments impose specific obligations on carrier licence holders and carriage service providers (CSPs). Carrier licence holders must maintain a register of critical telecommunications assets and report cybersecurity incidents to the relevant authorities. CSPs are required to comply with these rules in relation to the carriage services they provide. Both sets of obligations are designed to enhance the security of Australia's telecommunications infrastructure and to ensure that relevant authorities are promptly informed of any cybersecurity incidents. Failure to comply with the obligations set out in these instruments can result in various consequences. For carrier licence holders and CSPs, non-compliance may lead to enforcement actions by the telecommunications regulator. The specific penalties for non-compliance are not detailed in the Explanatory Statement but can include fines, compliance orders, or even the suspension or revocation of carrier licences or service provider authorisations. The exact penalties would be determined based on the nature and severity of the non-compliance and would be in accordance with the provisions of the Tel Act. The Department of Communications and the relevant Minister have assessed that the extension of these instruments will have more than minor impacts in terms of their operation, given their importance to the security of Australia's telecommunications infrastructure. The Department has determined that the instruments are operating efficiently and effectively, and the certification of this assessment will be published by the Office of Impact Analysis for transparency purposes. The Statement of Compatibility with Human Rights, originally published with the 2022 instruments, remains applicable to these amendments.