<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><div dir="auto" style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><font face="Helvetica" size="2">Does anyone know which laws cover the data they were keeping?</font><div><font face="Helvetica" size="2"><br></font></div><div><font face="Helvetica" size="2">Did a search for anything with "telecommunication" in the name (<a href="https://www.legislation.gov.au/Browse/ByTitle/Acts/InForce/0/telecommunication/All/">link</a>), found 71 results and downloaded 73 PDF files (C2022C00170 Telecommunications Act 1997 had 3 files, all others had 1 file), and can't find anything that mentions keeping this level of data. </font></div><div><font face="Helvetica" size="2"><br></font></div><div><font face="Helvetica" size="2">The closest thing I found was in the following:</font></div><div><font face="Helvetica" size="2"><br></font></div><div><div><font face="Helvetica" size="2">C2022C00151 - Telecommunications (Interception and Access) Act 1979</font></div><div><font face="Helvetica" size="2">C2015A00039 - Telecommunications (Interception and Access) Amendment (Data Retention) Act 2015</font></div><div><font face="Helvetica" size="2">C2021A00078 - Telecommunications Legislation Amendment (International Production Orders) Act 2021</font></div></div><div><font face="Helvetica" size="2"><br></font></div><div><font face="Helvetica" size="2">which contained the following two sections that seem to cover identification information - there doesn't seem to be anything that says they need to collect or store to the level that Optus seems to have done.. Almost reads like you could store name and address (without DOB?) and that would be adequate enough (but I'm not a lawyer so who knows).. Am I looking in the wrong place/at the wrong laws?</font></div><div><font size="2" face="Arial"><br></font></div><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><div><div style="font-size: 9px;"><font size="2" style="font-size: 10px;" face="Arial">13 Identification of a particular person</font></div></div><div style="font-size: 9px;"><div><font size="2" style="font-size: 10px;" face="Arial">For the purposes of this Schedule, a particular person may be identified:</font></div></div><div style="font-size: 9px;"><div><font size="2" style="font-size: 10px;" face="Arial">(a) by the person’s full name; or</font></div></div><div style="font-size: 9px;"><div><font size="2" style="font-size: 10px;" face="Arial">(b) by a name by which the person is commonly known; or</font></div></div><div style="font-size: 9px;"><div><font size="2" style="font-size: 10px;" face="Arial">(c) as the person to whom a particular individual transmission service is supplied; or</font></div></div><div style="font-size: 9px;"><div><font size="2" style="font-size: 10px;" face="Arial">(d) as the person to whom a particular individual message/call application service is provided; or</font></div></div><div style="font-size: 9px;"><div><font size="2" style="font-size: 10px;" face="Arial">(e) as the person who has a particular account with a prescribed communications provider; or</font></div></div><div style="font-size: 9px;"><div><font size="2" style="font-size: 10px;" face="Arial">(f) as the person who has a particular telephone number; or</font></div></div><div style="font-size: 9px;"><div><font size="2" style="font-size: 10px;" face="Arial">(g) as the person who has a particular email address; or</font></div></div><div style="font-size: 9px;"><div><font size="2" style="font-size: 10px;" face="Arial">(h) as the person who has a particular internet protocol address; or</font></div></div><div style="font-size: 9px;"><div><font size="2" style="font-size: 10px;" face="Arial">(i) as the person who has a device that has a particular unique identifier (for example, an electronic serial number or a Media Access Control address); or</font></div></div><div><div style="font-size: 9px;"><font size="2" style="font-size: 10px;" face="Arial">(j) by any other unique identifying factor that is applicable to the person.</font></div></div></blockquote><div><font size="2" face="Arial"><br></font></div><div><font size="2" face="Arial">and</font></div><div><font size="2" face="Arial"><br></font></div><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><div><div style="font-size: 9px;"><font size="2" style="font-size: 10px;" face="Arial">187AA Information to be kept</font></div></div><div style="font-size: 9px;"><div><font size="2" style="font-size: 10px;" face="Arial">(1) The following table sets out the kinds of information that a service provider must keep, or cause to be kept, under subsection 187A(1):</font></div></div><div style="font-size: 9px;"><div><b><font size="2" style="font-size: 10px;" face="Arial">Item</font></b></div></div></blockquote><blockquote style="margin: 0px 0px 0px 40px; border: none; padding: 0px; font-size: 9px;"><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><div><div><font size="2" style="font-size: 10px;" face="Arial">1</font></div></div></blockquote></blockquote><blockquote style="margin: 0px 0px 0px 40px; border: none; padding: 0px; font-size: 9px;"><div><div><b><font size="2" style="font-size: 10px;" face="Arial">Topic</font></b></div></div></blockquote><blockquote style="margin: 0px 0px 0px 40px; border: none; padding: 0px; font-size: 9px;"><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><div><div><font size="2" style="font-size: 10px;" face="Arial">The subscriber of, and accounts, services, telecommunications devices and other relevant services relating to, the relevant service</font></div></div></blockquote></blockquote><blockquote style="margin: 0px 0px 0px 40px; border: none; padding: 0px; font-size: 9px;"><div><div><b><font size="2" style="font-size: 10px;" face="Arial">Description of information</font></b></div></div></blockquote><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><blockquote style="margin: 0px 0px 0px 40px; border: none; padding: 0px; font-size: 9px;"><div><div><font size="2" style="font-size: 10px;" face="Arial">The following:</font></div></div></blockquote><blockquote style="margin: 0px 0px 0px 40px; border: none; padding: 0px; font-size: 9px;"><div><div><font size="2" style="font-size: 10px;" face="Arial">(a) <span class="Apple-tab-span" style="white-space:pre"> </span>any information that is one or both of the following:</font></div></div></blockquote><blockquote style="margin: 0px 0px 0px 40px; border: none; padding: 0px; font-size: 9px;"><div><div><font size="2" style="font-size: 10px;" face="Arial"><span class="Apple-tab-span" style="white-space:pre"> </span>(i) any name or address information;</font></div></div></blockquote><blockquote style="margin: 0px 0px 0px 40px; border: none; padding: 0px; font-size: 9px;"><div><div><font size="2" style="font-size: 10px;" face="Arial"><span class="Apple-tab-span" style="white-space:pre"> </span>(ii) any other information for identification purposes; </font></div></div></blockquote><blockquote style="margin: 0px 0px 0px 40px; border: none; padding: 0px; font-size: 9px;"><div><div><font size="2" style="font-size: 10px;" face="Arial"><span class="Apple-tab-span" style="white-space:pre"> </span>relating to the relevant service, being information used by the service provider for the purposes of identifying the subscriber of the relevant service;</font></div></div></blockquote><blockquote style="margin: 0px 0px 0px 40px; border: none; padding: 0px; font-size: 9px;"><div><div><font size="2" style="font-size: 10px;" face="Arial">(b) <span class="Apple-tab-span" style="white-space:pre"> </span>any information relating to any contract, agreement or arrangement relating to the relevant service, or to any related account, service or device;</font></div></div></blockquote><blockquote style="margin: 0px 0px 0px 40px; border: none; padding: 0px; font-size: 9px;"><div><div><font size="2" style="font-size: 10px;" face="Arial">(c) <span class="Apple-tab-span" style="white-space:pre"> </span>any information that is one or both of the following:</font></div></div></blockquote><blockquote style="margin: 0px 0px 0px 40px; border: none; padding: 0px; font-size: 9px;"><div><div><font size="2" style="font-size: 10px;" face="Arial"><span class="Apple-tab-span" style="white-space:pre"> </span>(i) billing or payment information; </font></div></div></blockquote><blockquote style="margin: 0px 0px 0px 40px; border: none; padding: 0px; font-size: 9px;"><div><div><font size="2" style="font-size: 10px;" face="Arial"><span class="Apple-tab-span" style="white-space:pre"> </span>(ii) contact information;</font></div></div></blockquote><blockquote style="margin: 0px 0px 0px 40px; border: none; padding: 0px; font-size: 9px;"><div><div><font size="2" style="font-size: 10px;" face="Arial"><span class="Apple-tab-span" style="white-space:pre"> </span>relating to the relevant service, being information used by the service provider in relation to the relevant service;</font></div></div></blockquote><blockquote style="margin: 0px 0px 0px 40px; border: none; padding: 0px; font-size: 9px;"><div><div><font size="2" style="font-size: 10px;" face="Arial">(d) <span class="Apple-tab-span" style="white-space:pre"> </span>any identifiers relating to the relevant service or any related account, service or device, being information used by the service provider in relation to the relevant service or any related account, service or device;</font></div></div></blockquote><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><div><div style="font-size: 9px;"><font size="2" style="font-size: 10px;" face="Arial">(e) <span class="Apple-tab-span" style="white-space: pre;"> </span>he status of the relevant service, or any related account, service or device.</font></div></div></blockquote></blockquote><br><div><div><br><blockquote type="cite"><div>On 27 Sep 2022, at 11:12, Nathan Brookfield <Nathan.Brookfield@iperium.com.au> wrote:</div><br class="Apple-interchange-newline"><div><div>They’re legally obligated to retain it but why it’s on the API and why it’s not encrypted.<br><br>Looking at the data some fields are hashed and then repeated in the bloody clear :(<br><br>On 27 Sep 2022, at 11:02, glenn.satchell@uniq.com.au wrote:<br><br>My understanding was that the data included the 100 points of ID info. Why are they retaining this? Surely after confirming the 100 points there only needs to be a record "100 points provided"=true and not retain the actual details. This goes back to only keeping the private data you need.<br><br>regards,<br>Glenn<br><br>On 2022-09-27 10:49, Damien Gardner Jnr wrote:<br><blockquote type="cite">Personally, I find putting Authentication on my API endpoints to be a<br>FANTASTIC first step towards API security. And then not even using<br>public IP addresses in test environments is a pretty good second<br>step.. </onlyhalfsarcasticherewhydoesthiskeephappening><br>On Tue, 27 Sept 2022 at 10:46, Bevan Slattery <bevan@slattery.net.au><br>wrote:<br><blockquote type="cite">Hi everyone,<br>Obviously a big week in telco and cybersecurity. As part of my work<br>I am on the Australian Cyber Security Industry Advisory Committee as<br>an industry representative.<br>I am keen to look at opening up a dialogue with more and more telco,<br>DC and Cloud CISO’s on what they are doing around this issue and<br>looking to take a proactive step towards best practice on customer<br>data and system security.<br>There will be some pretty serious consequences of this hack on the<br>industry and importantly we need to make sure we are as best placed<br>to help each other continually increase in security posture through<br>best practice, but also working with each other as an industry.<br>Are people keen on having a online/VC session sometime in the next<br>few weeks where like-minded industry participants get together and<br>discuss security, retention, encryption, threat detection etc.? If<br>so, just ping me directly and if there is enough interest I will<br>send out an invitation to the list for a call.<br>Cheers<br>[b]<br>_______________________________________________<br>AusNOG mailing list<br>AusNOG@ausnog.net<br>https://lists.ausnog.net/mailman/listinfo/ausnog<br></blockquote>--<br>Damien Gardner Jnr<br>VK2TDG. Dip EE. GradIEAust<br>rendrag@rendrag.net - http://www.rendrag.net/<br>--<br>We rode on the winds of the rising storm,<br>We ran to the sounds of thunder.<br>We danced among the lightning bolts,<br>and tore the world asunder<br>_______________________________________________<br>AusNOG mailing list<br>AusNOG@ausnog.net<br>https://lists.ausnog.net/mailman/listinfo/ausnog<br></blockquote>_______________________________________________<br>AusNOG mailing list<br>AusNOG@ausnog.net<br>https://lists.ausnog.net/mailman/listinfo/ausnog<br>_______________________________________________<br>AusNOG mailing list<br>AusNOG@ausnog.net<br>https://lists.ausnog.net/mailman/listinfo/ausnog<br></div></div></blockquote></div><br></div></div></body></html>