<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><meta http-equiv="content-type" content="text/html; charset=utf-8"><div style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><div><font face="Helvetica" size="2">I'll stop referring to DOB because it seems valid and reasonable that it is kept - so I'll just mention the license number / passport number - which is what people really have an issue with.</font></div><div><font face="Helvetica" size="2"><br></font></div><div><font face="Helvetica" size="2">What I read in that law you linked to below (F2017L00399 - Telecommunications (Service Provider — Identity Checks for Prepaid Mobile Carriage Services) Determination 2017) actually says it's against the law to "record and keep" either "the identifying number of a government document" or "a category A document or category B document."</font></div><div><font face="Helvetica" size="2"><br></font></div><div><font face="Helvetica" size="2">They are allowed to "record or keep" the identification number for "permitted purposes" (verifying someones identity) and "only for such time as is reasonably necessary for the permitted purpose"</font></div><div><font face="Helvetica" size="2"><br></font></div><div><font face="Helvetica" size="2">Does anyone actually know where or how they are required by law to store a license number or passport number?? Or does everyone just assume they need to do this because others have said so, or they think the company needs to keep X years of records for their business (of which those records do <b>currently</b> include license number, but by law they don't need to include a license number - and by some laws, it's even against the law to store the license number)</font></div><div><br></div><div><div><br></div></div><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><div><div><div style="font-size: 10px;"><b>6.4 Restrictions on the recording and keeping of certain information</b></div></div></div><div><div style="font-size: 10px;"><br></div></div><div><div style="font-size: 10px;">(1) Subject to subsections (2) and (3), a carriage service provider must not, in connection with a requirement imposed by this Determination, record and keep:</div></div><div><div style="font-size: 10px;"> (a) the identifying number of a government document; or</div></div><div><div style="font-size: 10px;"> (b) a category A document or category B document.</div></div><div><div style="font-size: 10px;"> (2) Subsection (1) does not prohibit the recording and keeping of information or a document if that recording and keeping is required or authorised by or under a law.</div></div><div><div style="font-size: 10px;"><br></div></div><div><div style="font-size: 10px;"><div>(3) Subsection (1) does not prohibit the recording and keeping of the identifying number of a government document where:</div></div></div><div><div style="font-size: 10px;"><div> (a) the carriage service provider records the identifying number of a government document for a permitted purpose; and</div></div></div><div><div style="font-size: 10px;"><div> (b) the carriage service provider records the information only for such time as is reasonably necessary for the permitted purpose; and</div></div></div><div><div style="font-size: 10px;"><div> (c) immediately after the carriage service provider verifies the service activator’s identity, the carriage service provider destroys the number; and</div></div></div><div><div style="font-size: 10px;"><div> (d) the recording is not otherwise prohibited by law.</div></div></div><div><div style="font-size: 10px;"><div> Example If a customer has unsuccessfully attempted to verify their identity online using a government online verification service, a carriage service provider may use the identifying number of that customer’s government document to assist that customer to verify his or her identity</div></div></div><div><div style="font-size: 10px;"><br></div></div><div><div style="font-size: 10px;"><div>(4) A carriage service provider must not copy or reproduce any document that contains the information which must not be recorded and kept because of subsection (1).</div></div></div><div><div style="font-size: 10px;"><div> Note A carriage service provider’s arrangements for recording and handling personal information must comply with Commonwealth privacy laws where applicable.</div></div></div><div><div style="font-size: 10px;"><div><br></div></div></div><div><div style="font-size: 10px;"><div>(5) In this section:</div></div></div><div><div style="font-size: 10px;"><div> permitted purpose means:</div></div></div><div><div style="font-size: 10px;"><div> (a) the purpose of verifying the identity of a service activator in accordance with section 4.5; or</div></div></div><div><div style="font-size: 10px;"><div> (b) any other purpose that is ancillary or incidental to the provider’s obligation to verify the identity of a service activator in accordance with section 4.5.</div></div></div><div><div style="font-size: 10px;"><br></div></div><div><div style="font-size: 10px;"><div><b>4.5 Verification of the identity of a customer who is a service activator</b></div></div></div><div><div style="font-size: 10px;"><div> (1) This section applies to the carriage service provider if the customer is a service activator.</div></div></div><div><div style="font-size: 10px;"><div> (2) The carriage service provider must verify the identity of the service activator using an approved method of identity verification specified in column B of Schedule 1</div></div></div></blockquote><div><div><br></div><div><br></div><div><br></div><div><br><blockquote type="cite"><div>On 28 Sep 2022, at 09:44, Jeremy Chequer <jeremy@resolvergroup.com.au> wrote:</div><br class="Apple-interchange-newline"><div>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div lang="EN-AU" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1"><p class="MsoNormal"><span style="mso-fareast-language:EN-US">Hi<o:p></o:p></span></p><p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p><p class="MsoNormal"><span style="mso-fareast-language:EN-US">There are specific rules for prepaid regarding ID validation and documents which must be checked (<a href="https://www.legislation.gov.au/Details/F2017L00399/Html/Text#_Toc478627158">https://www.legislation.gov.au/Details/F2017L00399/Html/Text#_Toc478627158</a>).
As a Credit Provider, they are also required to validate you are who you say you are before providing credit services. Additionally, telcos also have specific provisions for customer protection requiring credit checks to be run before certain services are
provided.<o:p></o:p></span></p><p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p><p class="MsoNormal"><span style="mso-fareast-language:EN-US">Providers also need to keep enough information to verify you are who you say you are when you make contact though and are required to ensure they don’t disclose information about your account to
someone else, which is why many providers keep things like your Date of Birth on file. The requirement to hold PII is required to a degree and is even outlined in the TCP Code with Clause 3.7 covering the storage and security of said information.
<o:p></o:p></span></p><p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p><p class="MsoNormal"><span style="mso-fareast-language:EN-US">Hopefully, this attack will result in some changes not just in our industry but across the board. Maybe something like validating Licences, Medicare, etc against DVS (already commonly done) but then
just keeping the Pass/Fail result and Check ID instead of keeping the full details on file could be a way to minimise the amount of data available in a breach like this, but I’m not sure if that would be enough to comply with some of the obligations.<o:p></o:p></span></p><p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p><p class="MsoNormal">- Jeremy <o:p></o:p></p><p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm"><p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> AusNOG <ausnog-bounces@ausnog.net>
<b>On Behalf Of </b>James Murphy<br>
<b>Sent:</b> Tuesday, 27 September 2022 11:29 PM<br>
<b>To:</b> Serge Burjak <sburjak@systech.com.au><br>
<b>Cc:</b> AusNOG Mailing List <ausnog@ausnog.net><br>
<b>Subject:</b> Re: [AusNOG] Optus Hack<o:p></o:p></span></p>
</div>
</div><p class="MsoNormal"><o:p> </o:p></p>
<div><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Helvetica",sans-serif">Looking over the Privacy Act and oaic.gov.au, I still can't see any laws about a telco (or any business other than a credit reporting body) storing this level of information
- specifically a drivers license number or date of birth (passport number isn't mentioned)</span><o:p></o:p></p>
</div>
<div>
<div><p class="MsoNormal"><o:p> </o:p></p>
</div>
<div><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Helvetica",sans-serif">"identification information" is the term that includes a drivers license number and date of birth</span><o:p></o:p></p>
</div>
<div><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Helvetica",sans-serif">"Credit information" is the term that includes "identification information" about an individual (therefor includes drivers license number and date of birth)</span><o:p></o:p></p>
</div>
<div><p class="MsoNormal"><o:p> </o:p></p>
</div>
<div><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Helvetica",sans-serif">There are only laws about how long a credit reporting body stores this information. A credit provider (ie Optus) doesn't need to store it, but does need to provide it to
the credit reporting body - so they need to collect it and share it but they don't need to store it.</span><o:p></o:p></p>
</div>
<div><p class="MsoNormal"><o:p> </o:p></p>
</div>
<div><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Helvetica",sans-serif">For the data a telco does need to store - which looks to be added in the "Telecommunications (Interception and Access) Act 1979", they all talk about "personal information"
(which doesn't specifically include date of birth or drivers license number, so you would be complying with that law if you didn't store those pieces of data - provided you can reasonably identify a person with the data you do store)</span><o:p></o:p></p>
</div>
<div><p class="MsoNormal"><o:p> </o:p></p>
</div>
<div><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Helvetica",sans-serif">From the Privacy Act:</span><o:p></o:p></p>
</div>
<div><p class="MsoNormal"><o:p> </o:p></p>
</div>
<blockquote style="margin-left:30.0pt;margin-right:0cm">
<div>
<div><p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Helvetica",sans-serif">personal information</span></b><span style="font-size:10.0pt;font-family:"Helvetica",sans-serif"> means information or an opinion about an identified individual, or an
individual who is reasonably identifiable:</span><o:p></o:p></p>
</div>
</div>
<div>
<div><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Helvetica",sans-serif">(a) whether the information or opinion is true or not; and</span><o:p></o:p></p>
</div>
</div>
<div>
<div><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Helvetica",sans-serif">(b) whether the information or opinion is recorded in a material form or not.</span><o:p></o:p></p>
</div>
</div>
<div>
<div><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Helvetica",sans-serif">Note: Section 187LA of the Telecommunications (Interception and Access) Act 1979 extends the meaning of personal information to cover information kept under Part 5-1A of
that Act.</span><o:p></o:p></p>
</div>
</div>
</blockquote>
<div><p class="MsoNormal"><o:p> </o:p></p>
</div><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Helvetica",sans-serif">So the argument that they need to store this by law - to me (a software developer/techy who sometimes can spend hours reading shit like this trying to pick holes in it -
so: not a lawyer) - doesn't seem valid.</span><o:p></o:p></p>
<div><p class="MsoNormal"><o:p> </o:p></p>
</div>
<div><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Helvetica",sans-serif">If this is required by law, I would love to understand how (ie which laws/acts cover it)</span><o:p></o:p></p>
<div>
<div><p class="MsoNormal"><o:p> </o:p></p>
</div>
<div><p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<div><p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div><p class="MsoNormal">On 27 Sep 2022, at 16:46, Serge Burjak <<a href="mailto:sburjak@systech.com.au">sburjak@systech.com.au</a>> wrote:<o:p></o:p></p>
</div><p class="MsoNormal"><o:p> </o:p></p>
<div>
<div><p class="MsoNormal"><a href="https://www.oaic.gov.au/privacy/the-privacy-act">https://www.oaic.gov.au/privacy/the-privacy-act</a><br>
<br>
Covers it pretty well.<br>
<br>
On Tue, 27 Sept 2022 at 16:36, James Murphy <<a href="mailto:jamesmurphyau@me.com">jamesmurphyau@me.com</a>> wrote:<br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt"><p class="MsoNormal"><br>
Does anyone know which laws cover the data they were keeping?<br>
<br>
Did a search for anything with "telecommunication" in the name (link), found 71 results and downloaded 73 PDF files (C2022C00170 Telecommunications Act 1997 had 3 files, all others had 1 file), and can't find anything that mentions keeping this level of data.<br>
<br>
The closest thing I found was in the following:<br>
<br>
C2022C00151 - Telecommunications (Interception and Access) Act 1979<br>
C2015A00039 - Telecommunications (Interception and Access) Amendment (Data Retention) Act 2015<br>
C2021A00078 - Telecommunications Legislation Amendment (International Production Orders) Act 2021<br>
<br>
which contained the following two sections that seem to cover identification information - there doesn't seem to be anything that says they need to collect or store to the level that Optus seems to have done.. Almost reads like you could store name and address
(without DOB?) and that would be adequate enough (but I'm not a lawyer so who knows).. Am I looking in the wrong place/at the wrong laws?<br>
<br>
13 Identification of a particular person<br>
For the purposes of this Schedule, a particular person may be identified:<br>
(a) by the person’s full name; or<br>
(b) by a name by which the person is commonly known; or<br>
(c) as the person to whom a particular individual transmission service is supplied; or<br>
(d) as the person to whom a particular individual message/call application service is provided; or<br>
(e) as the person who has a particular account with a prescribed communications provider; or<br>
(f) as the person who has a particular telephone number; or<br>
(g) as the person who has a particular email address; or<br>
(h) as the person who has a particular internet protocol address; or<br>
(i) as the person who has a device that has a particular unique identifier (for example, an electronic serial number or a Media Access Control address); or<br>
(j) by any other unique identifying factor that is applicable to the person.<br>
<br>
<br>
and<br>
<br>
187AA Information to be kept<br>
(1) The following table sets out the kinds of information that a service provider must keep, or cause to be kept, under subsection 187A(1):<br>
Item<br>
<br>
1<br>
<br>
Topic<br>
<br>
The subscriber of, and accounts, services, telecommunications devices and other relevant services relating to, the relevant service<br>
<br>
Description of information<br>
<br>
The following:<br>
<br>
(a) any information that is one or both of the following:<br>
<br>
(i) any name or address information;<br>
<br>
(ii) any other information for identification purposes;<br>
<br>
relating to the relevant service, being information used by the service provider for the purposes of identifying the subscriber of the relevant service;<br>
<br>
(b) any information relating to any contract, agreement or arrangement relating to the relevant service, or to any related account, service or device;<br>
<br>
(c) any information that is one or both of the following:<br>
<br>
(i) billing or payment information;<br>
<br>
(ii) contact information;<br>
<br>
relating to the relevant service, being information used by the service provider in relation to the relevant service;<br>
<br>
(d) any identifiers relating to the relevant service or any related account, service or device, being information used by the service provider in relation to the relevant service or any related account, service or device;<br>
<br>
(e) he status of the relevant service, or any related account, service or device.<br>
<br>
<br>
<br>
On 27 Sep 2022, at 11:12, Nathan Brookfield <<a href="mailto:Nathan.Brookfield@iperium.com.au">Nathan.Brookfield@iperium.com.au</a>> wrote:<br>
<br>
They’re legally obligated to retain it but why it’s on the API and why it’s not encrypted.<br>
<br>
Looking at the data some fields are hashed and then repeated in the bloody clear :(<br>
<br>
On 27 Sep 2022, at 11:02, <a href="mailto:glenn.satchell@uniq.com.au">glenn.satchell@uniq.com.au</a> wrote:<br>
<br>
My understanding was that the data included the 100 points of ID info. Why are they retaining this? Surely after confirming the 100 points there only needs to be a record "100 points provided"=true and not retain the actual details. This goes back to only
keeping the private data you need.<br>
<br>
regards,<br>
Glenn<br>
<br>
On 2022-09-27 10:49, Damien Gardner Jnr wrote:<br>
<br>
Personally, I find putting Authentication on my API endpoints to be a<br>
FANTASTIC first step towards API security. And then not even using<br>
public IP addresses in test environments is a pretty good second<br>
step.. </onlyhalfsarcasticherewhydoesthiskeephappening><br>
On Tue, 27 Sept 2022 at 10:46, Bevan Slattery <<a href="mailto:bevan@slattery.net.au">bevan@slattery.net.au</a>><br>
wrote:<br>
<br>
Hi everyone,<br>
Obviously a big week in telco and cybersecurity. As part of my work<br>
I am on the Australian Cyber Security Industry Advisory Committee as<br>
an industry representative.<br>
I am keen to look at opening up a dialogue with more and more telco,<br>
DC and Cloud CISO’s on what they are doing around this issue and<br>
looking to take a proactive step towards best practice on customer<br>
data and system security.<br>
There will be some pretty serious consequences of this hack on the<br>
industry and importantly we need to make sure we are as best placed<br>
to help each other continually increase in security posture through<br>
best practice, but also working with each other as an industry.<br>
Are people keen on having a online/VC session sometime in the next<br>
few weeks where like-minded industry participants get together and<br>
discuss security, retention, encryption, threat detection etc.? If<br>
so, just ping me directly and if there is enough interest I will<br>
send out an invitation to the list for a call.<br>
Cheers<br>
[b]<br>
_______________________________________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@ausnog.net">AusNOG@ausnog.net</a><br>
<a href="https://lists.ausnog.net/mailman/listinfo/ausnog">https://lists.ausnog.net/mailman/listinfo/ausnog</a><br>
<br>
--<br>
Damien Gardner Jnr<br>
VK2TDG. Dip EE. GradIEAust<br>
<a href="mailto:rendrag@rendrag.net">rendrag@rendrag.net</a> - <a href="http://www.rendrag.net/">http://www.rendrag.net/</a><br>
--<br>
We rode on the winds of the rising storm,<br>
We ran to the sounds of thunder.<br>
We danced among the lightning bolts,<br>
and tore the world asunder<br>
_______________________________________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@ausnog.net">AusNOG@ausnog.net</a><br>
<a href="https://lists.ausnog.net/mailman/listinfo/ausnog">https://lists.ausnog.net/mailman/listinfo/ausnog</a><br>
<br>
_______________________________________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@ausnog.net">AusNOG@ausnog.net</a><br>
<a href="https://lists.ausnog.net/mailman/listinfo/ausnog">https://lists.ausnog.net/mailman/listinfo/ausnog</a><br>
_______________________________________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@ausnog.net">AusNOG@ausnog.net</a><br>
<a href="https://lists.ausnog.net/mailman/listinfo/ausnog">https://lists.ausnog.net/mailman/listinfo/ausnog</a><br>
<br>
<br>
_______________________________________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@ausnog.net">AusNOG@ausnog.net</a><br>
<a href="https://lists.ausnog.net/mailman/listinfo/ausnog">https://lists.ausnog.net/mailman/listinfo/ausnog</a><o:p></o:p></p>
</blockquote>
</div>
</div>
</blockquote>
</div><p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div></blockquote></div><br></div></div></body></html>