19 January 2016 Cyber and Identity Security Policy Branch Attorney-General's Department 3-5 National Circuit BARTON ACT 2600 By email to telco.security@ag.gov.au Telecommunications and Other Legislation Amendment Bill 2015 Foxtel appreciates the opportunity to comment on the Government’s second exposure draft of the Telecommunications and Other Legislation Amendment Bill 2015 (the Bill) released 27 November 2015 for public consultation. Foxtel is a carriage service provider (CSP) of residential telephony and broadband services and provides broadcasting and content services over cable, satellite and broadband distribution platforms. Foxtel notes that a number of issues raised by submissions in response to the first exposure draft have been addressed in the second exposure draft. Foxtel’s primary concerns are around the scope of the new protection obligations in sections 313(1A) and 313(2A), the new notification requirements for carriers and nominated CSPs in section 314A, and the potential application of these sections to networks and facilities used to supply broadcasting and content services. The aims of the Bill are to put in place a regulatory framework to better manage national security risks to telecommunications services and networks, given the potentially sensitive nature of information contained on and travelling across telecommunications networks and facilities, including, for example, information about lawful intercept systems and sensitive law enforcement operations or the location of people such as politicians or protected persons.1 The Explanatory Memorandum further notes that telecommunications networks and systems are also critical infrastructure vital to the delivery and support of other critical infrastructure and services, such as, power, water and health.2 Unclear scope of the new protection obligations in ss. 313(1A) and (2A) The Bill builds on existing provisions in the Telecommunications Act 1997 and Telecommunications (Interception and Access) Act 1979 (for example, in section 313 of the Telecommunications Act) and establishes new protection obligations in sections 313(1A) and 313(2A) for the ‘purposes of national security’. The new protection obligations apply to the ‘telecommunications networks’ and ‘facilities’ of carriers, carriage service providers and carriage service 1 Foxtel Management Pty Ltd ABN 65 068 671 983 5 Thomas Holt Drive Paragraphs 1-2, p. 2, Telecommunications and Other Legislation Amendment Bill 2015 - Explanatory North Ryde NSW 2113 Australia GPO Box 99 Sydney NSW 2001 Memorandum. 2 Paragraphs 2, p. 2, Telecommunications and Other Legislation Amendment Bill 2015 - Explanatory T: +61 2 9813 6000 foxtel.com.au Memorandum. intermediaries. ‘Telecommunications networks’ and ‘facilities’ are broadly defined in the Telecommunications Act and may include infrastructure and facilities used to supply broadcasting and content services not just infrastructure and facilities used to supply traditional telephony and broadband services.3 Therefore, as currently drafted, the new protection obligations in section 313(1A) and section 313(2A) may not be simply confined to traditional carrier/CSP activities on ‘network units’ relating to carriage of point-to-point voice/internet communications, but may also include any activities relating to any ‘telecommunications network’ or ‘facilities’ that carry communications – which could include infrastructure and facilities used to supply broadcasting and content services. For Foxtel, this means that as a carriage service provider of telephony and broadband services, it’s not clear whether its broadcasting and content infrastructure and facilities will also be subject to the new protection obligations and, if Foxtel becomes a carrier or nominated CSP in future, its broadcasting and content infrastructure and facilities may therefore also be subject to the new notification requirements in section 314A. Foxtel seeks clarification that networks and facilities used to supply broadcasting and content services are not intended to be subject to the new obligations in sections 313(1A) and 313(2A) or the notification requirements in section 314A. Proposed amendments to ss. 313(1A) and (2A) Foxtel submits that sections 313(1A) and 313(2A) should be amended to expressly exclude telecommunications networks and facilities to the extent that these are used to supply ‘broadcasting services’ and ‘content services’ (as defined in the Broadcasting Services Act 1992) 4 from the new protection obligations. Foxtel does not consider that it is intended that networks and facilities used to supply broadcasting and content services be subject to these provisions because of the fundamentally different nature of broadcasting and content services as compared with telecommunications services. Further, if networks and facilities used to supply broadcasting and content services are subject to these provisions, this would create a regulatory imbalance within the Australian broadcasting industry. Broadcasting and content services can play an important role in informing the community—both in relation to issues of public interest and in times of emergency. That said, depending on the service, they can also be characterised as discretionary entertainment services. However, in contrast to the reasons for introducing this new ‘Telecommunications network’ means ‘a system, or series of systems, that carries, or is capable of carrying, communications by means of guided and/or unguided electromagnetic energy’. Facility’ means (a) any part of the infrastructure of a telecommunications network; or (b) any line, equipment, apparatus, tower, mast, antenna, tunnel, duct, hole, pit, pole or other structure or thing used, or for use, in or in connection with a telecommunications network. Section 7, Telecommunications Act 1997. 3 The definition of ‘broadcasting service’ in the Broadcasting Services Act 1992 excludes video-ondemand services (it excludes ‘programs available on demand on a point-to-point basis’). Video-ondemand services come within the definition of ‘content service’ in schedule 7 of the Broadcasting Services Act 1992. 4 2 regulatory framework as outlined in the Explanatory Memorandum, broadcasting and content services do not carry sensitive corporate or government information or sensitive, confidential information about law enforcement activities. Nor do broadcasting and content services carry protected information or potentially disclose the location of politicians or other protected persons and they are not essential to the delivery and support of critical services, such as, power, water and health. Further, the additional interpretive material in the Explanatory Memorandum and the draft guidelines5 explore the application of the regulatory framework to the ICT sector and more traditional telephony and broadband services, rather than the media sector and broadcasting and content services. We also believe it would create a regulatory imbalance if Foxtel’s broadcasting and content facilities are subject to this regulation and other media providers, including free-to-air television providers who have near ubiquitous penetration and larger audiences than Foxtel, are not. Foxtel has a clear business incentive to protect its broadcasting and content infrastructure and facilities without these facilities being subject to this additional regulation. For these reasons, Foxtel seeks amendments to sections 313(1A) and 313(2A) that expressly exempt telecommunications networks and facilities ‘to the extent these are used to supply broadcasting services and content services as defined in the Broadcasting Services Act 1992’. Alternatively, sections 313(1A) and 313(2A) could be amended to expressly exempt telecommunications networks and facilities, ‘to the extent that these are used to supply broadcasting services and content services as defined in the Broadcasting Services Act 1992, except where these telecommunication networks and facilities are ‘network units’ as defined in the Telecommunications Act.’ This would provide clarity that telecommunications networks and facilities used to supply broadcasting or content services would not be subject to the obligations in section 313(1A) and 313(2A). Proposed amendment to section 314A Section 314A introduces new notification requirements where a carrier or a nominated CSP must notify the Communications Access Coordinator (CAC) where a proposed change to a ‘telecommunications service’ or ‘telecommunications system’ is likely to have a material adverse effect on their ability to comply with the protection obligations in sections 313(1A) or 313(2A). The term ‘telecommunications service’ and ‘telecommunications system’ used in section 314A (and as defined in the Telecommunications (Interception and Access Act) 1979) are also defined broadly. Again, it is unclear whether these provisions include networks and facilities used to supply broadcasting and content services. 5 Telecommunications Sector Security Guidelines: Knowing your legislative obligations to protect telecommunications networks and facilities from unauthorised access and interference – Draft version, November 2015. 3 The CAC is able to grant an exemption (or partial exemption) to a carrier or nominated CSP from the notification requirements,6 but, there is no application process for an exemption included in the legislation – exemptions can only be granted at the CAC’s discretion.7 However, the Explanatory Memorandum notes that the CAC could grant an exemption in respect of part of a business, for example, subscription television services.8 Foxtel considers this provides support for the argument that networks and facilities used to supply broadcasting and content services are not intended to be subject to the protection obligations in sections 313(1A) and 313(2A) and the notification requirements in section 314A. Foxtel submits that, as there is no application process for exemptions and for the avoidance of doubt, section 314A should also be amended to expressly exclude networks and facilities to the extent that these are used to supply broadcasting services and content services (as defined by the Broadcasting Services Act 1992) from the notification requirements. This would provide clarity and certainty in relation to the application of the regulatory framework in future. Yours sincerely, Bruce Meagher Group Director, Corporate Affairs 6 Sections 314A(4) and 314A(5). Telecommunications and Other Legislation Amendment Bill 2015. 7 Explanatory Memorandum, Telecommunications and Other Legislation Amendment Bill 2015, paragraph 129, pp 27-28. 8 Explanatory Memorandum, Telecommunications and Other Legislation Amendment Bill 2015, paragraph 129, pp 27-28. 4