Telecommunications (Carrier Licence Conditions— Security Information) Amendment Declaration 2023

Overview

The Telecommunications (Carrier Licence Conditions – Security Information) Amendment Declaration 2023 and the Telecommunications (Carriage Service Provider – Security Information) Amendment Determination 2023 were enacted to extend the existing carrier licence conditions and service provider rules concerning the maintenance of a register of critical telecommunications assets and the mandatory reporting of cybersecurity measures. These amendments were introduced by the Minister for Communications, the Hon Michelle Rowland MP, under the authority provided by the Telecommunications Act 1997. The original instruments, established in July 2022, aimed to ensure that telecommunications carriers and service providers uphold cybersecurity standards to protect critical infrastructure. The amendments extend these requirements by 18 months and adjust the sunset clauses to ensure the instruments will cease operation after a total of three years from their original enactment. This extension was made following a consultation period in late 2023, during which no substantial feedback was received from carrier licence holders. The amendments aim to maintain effective cybersecurity measures in the telecommunications sector.

Scope and Application

The Telecommunications (Carrier Licence Conditions—Security Information) Amendment Declaration 2023 and the Telecommunications (Carriage Service Provider—Security Information) Amendment Determination 2023 were made under the authority of the Minister for Communications, pursuant to Sections 63(1) and 63(3) and Section 99(1A) of the Telecommunications Act 1997. These instruments extend the existing requirements for carrier licenses and Carriage Service Providers (CSPs) to maintain a register of critical telecommunications assets and report on cyber security measures. They apply to all entities holding a carrier licence or providing carriage services within the Commonwealth of Australia, with the amendments extending the original timeframe by 18 months and setting a sunset clause for automatic repeal after a total of three years from the initial implementation. The amendments will take effect the day after their registration on the Federal Register of Legislation, and no substantial feedback was received during the consultation process as mandated by Section 64 of the Tel Act.

Key Provisions

The Telecommunications (Carrier Licence Conditions—Security Information) Amendment Declaration 2023 and the Telecommunications (Carriage Service Provider—Security Information) Amendment Determination 2023 (referred to as the instruments) are amendments to existing legislative instruments under the Telecommunications Act 1997. These instruments extend the timeframe of the original instruments made in July 2022 by 18 months and modify the sunset clauses to ensure they cease operation three years from their creation (Sections 4 of both Schedules 1). The primary purpose of these amendments is to maintain the existing framework for a register of critical telecommunications assets and the mandatory reporting of cybersecurity incidents, which are critical for the security of Australia's telecommunications infrastructure. The obligations imposed by these instruments primarily concern carrier licence holders and carriage service providers. They must maintain a register of critical telecommunications assets and report any cybersecurity incidents to the relevant authorities as stipulated in the amended conditions and determinations. This requirement ensures that all stakeholders are aware of potential threats and can take appropriate measures to mitigate risks. Additionally, these entities must comply with the extended timeframes and the new sunset clauses, which provide clarity on the duration of these obligations. Failure to comply with the obligations set out in these instruments can lead to serious consequences. The Telecommunications Act 1997 provides for various penalties for non-compliance, although specific penalties are not detailed in the Explanatory Statement. Generally, breaches of carrier licence conditions can result in fines, suspension, or even revocation of the licence. Similarly, non-compliance with the Service Provider Determination may also lead to penalties, including fines and other regulatory actions. These potential penalties underscore the importance of adhering to the cybersecurity reporting requirements set forth by the amended instruments. The instruments are designed to ensure that telecommunications infrastructure remains secure by requiring ongoing reporting and maintenance of asset registers. The legislative amendments provide a clear framework for compliance and enforcement, ensuring that the cybersecurity measures remain effective and up-to-date. The extension and modification of the sunset clauses further ensure that these measures are not in place indefinitely but are subject to periodic review and adjustment as necessary. This approach balances the need for robust cybersecurity measures with the flexibility to adapt to changing threats and technologies.