Senate Environment and Communications Legislation Committee, , 5:53:09 to 6:27:30
ACMA's internal review of regulatory processes and the development of the SMS Sender ID register are examined. Officials address security vulnerabilities that allowed fake names to be registered and the implementation of new identity verification layers.
Topics: Integrity, Government IT systems
Speakers: Nerida O'Loughlin, Cathy Rainsford, Sarah Hanson-Young, David Pocock, Hon Sarah Henderson, Jeremy Fenton, Varun Ghosh
I had some further questions about the media releases with uh companies that you're meant to be uh regulating. And this is um again uh reported in uh the ABC um by Mike Atkin and Allison Brley. I understand that you sent the draft media release to Commonwealth Bank and then someone um and you know CBA let's let's talk about what actually happened. CBA was caught pushing rewards programs, insurance, credit and load products and bank promotions onto millions of customers, including some who' never consented to them or had removed it and some who couldn't actually unsubscribe it's reported that a staff member from the bank's legal team called a senior ACMA executive. I'm interested who who
Um I I believe there were uh several conversations between uh the CBA and ACMA staff. Um and indeed uh I had uh at least one conversation.
>> Which other senior executives spoke to
>> Uh look I I would have to take that on notice.
>> Any anyone else here talk to? the decision made to delay your media release until after their AGM?
>> Um, there are a range of factors that go into um the ACMA deciding when um media releases go out, including other priorities on the ACMA's um agenda. And um the fact is in this matter CBA made the request um and the ACMA considered it um not unreasonable.
>> Mr. Fenton, that that is a that's ludicrous. This is this is the biggest fish you've ever landed as a regulator and you're telling me that combank, biggest company in the in the country, says to you, "Hey, reckon you could delay this after AGM? Could be a bit of a bad look." And you say, "Well, yeah, probably. We we can we can do that for you." Who had the final sign off to delay your media release until after Combanks?
>> I think it was the authority. I think it was put in terms of um the availability of CBA senior management um on the day of the release. Um
>> Senator. >> That's their problem. >> Senator,
>> Senator, we did not think it was unreasonable at the time, >> obviously. Um and we also had other releases going out on the same day. Um, and obviously we accept the criticism that's been
>> And you didn't you didn't discuss the this enormous company was asking you to delay a media release where you had found very serious breaches till after the AGM and you didn't think as as the one probably a bit fishy. two, if we do it could be a bad look if people find out. Surely that is part of your discussion as a senior management team, as the regulator that we're all we're all relying on you. And here we find time after time you find someone's done something wrong. Slap them on the wrist and say, "Well, here's the media release." And they say, "Could you edit this?" Sure. Or, "Hey, could you delay this till after a might be a little bit uncomfortable?"
>> Senator,
>> why is that happening?
>> We in those circumstances, we didn't think it was unreasonable. It was also a matter of the priorities we had in terms of releases going out. H
>> sorry chair, how is this not the biggest priority you have? This is Commonwealth Bank.
>> There were a number of um other activities that week. We accept your criticism.
>> Did you sign off on the delay till after the AGM?
>> I would expect that the authority did from memory. I can't I can't remember.
>> So who's who's the authority and who's the chair?
>> Uh the chair and the um authority
members. So, you signed off on it?
>> I can't remember, but I would expect it was something I made a decision on or was asked to make a call on for the team.
>> And what do you say to Com Bank shareholders um who accuse you of knowingly denying them the ability to ask questions of a company that they've invested in that you have have taken action against?
>> Well, Senator, um we've taken on board the criticism. Um I think ComBank released statements to the ASX um in regard to it
>> after their AGM
>> after their AGM. That's correct. Um we take on board the criticism and we'll consider that in improving our processes. I would say though that none of this um impacts on the very significant penalty that we applied to combank in these circumstances which
>> yeah this this reflects terribly on you and the ACMA you you you you tell this to any Australian just these two examples um I hope there's not more but there's there's probably more they would say that's not a regulator that is someone who
>> Senator, we've taken strong regulatory action against the CBA. I take on board your criticisms. That is something that we are absolutely aware of and we're changing our processes accordingly.
accountability for this? Like I'm just I'm just so concerned.
>> I'm happy to take accountability for it, Senator. And I'm happy to inform you that I've ordered a review across the organization the way we process these matters and we will change our processes, but I'm happy to take that account of it.
>> Um, will this review be made public or how will we sort of know what processes are in place?
>> Um, we don't intend to make it public. I think it will be made public by the approaches we make going forward. Um, I'm happy to take on notice to give you a bit more information about what we're proposing if that would be helpful.
>> Okay. Thank you. Thank you, Chair.
>> Thank you, Senator PCO. Senator Hanson Young.
Mr. Lachlan, you've you've said to uh Senator PCO that going forward this isn't going to be the practice. Um, of course, you know, we've seen the example with ComBank, with Sports Bet, with radio stations, with Optus and Telra. how many times did this have to be revealed before you thought it wasn't a good idea to get the people, the companies you regulate to sign off on your homework?
>> Senator, we didn't ask people to sign off on our homework. We were merely going through a procedural fairness process of advising those companies on which we were making public statements of the facts of what would be in the release. Various people came back to us wanting to change tone. We didn't. Some people identified, as I've mentioned previously, that there needed to be some corrections around things like uh company names. We felt at the time that the process we were taking under the obligations under the law and the general obligations for procedural fairness were appropriate. Um we take the criticisms that have been put to us on board. Um and we will change our processes accordingly. Um and
>> so what will the process be now?
Uh will I expect Senator we will not be giving people an opportunity to check any full press releases
>> and draft reports?
It will depend. It it will depend on what the report is and what it's directed to. Sorry, investigation reports. Um we do tend to under um as I said things like section 180 of the broadcasting services act provide draft investigation reports to for example the broadcasters for them to um provide additional information and evidence back to us. Uh so it will depend on the report and it'll depend on the process under which we're undertaking the investigation. So, of
course, uh, January last year, so 12 months ago, um, you got you allowed Optus to sign off on a a press release uh, issued a a the statement in relation to the fine um, that they were slapped on the wrist with you. And in relation to Senator Smith, you said that won't happen this time. I just want 100% confirmation. and Optus are not going to get a draft copy of the investigation report from September 18 and they won't be getting a copy of the press release.
Senator, I'm not quite sure what you're referring to, >> but it it is usually pra good practice where an investigation report may come to findings of um allowing procedural fairness with an investigated company to comment on those processes. That does not mean that we change things. It is a process.
>> Okay. But you I understand that Mr. Lockman, you keep trying to justify why you've done it so many times in the past, but you're telling us that you won't keep doing it in the future. >> So, either you understand that it was wrong,
>> Senator,
>> or you're asking or or you're asking us to just kind of move on, gloss over.
>> No, Senator, I'm I'm reflecting on the criticism, particularly around media
So, Optus will not be given uh the heads up of what is in uh what is in the investigation report before it's
>> In terms of the reports, Senator, we're obliged under procedural fairness to provide that opportunity. What I'm saying is that in terms of media releases, we will not be providing that opportunity in the future.
>> Okay. Um when is the uh investigation uh and the report due um in relation to the September 18 outage? Senator, as we
discussed with Senator Smith earlier, I can't give you a date on that. That will depend on the processes that we currently have underway, which is a very high priority for us.
>> Last time we asked you this, um you said you needed to make sure the shot review was um completed. That's completed. That's out. Correct. >> Uh so and that's that's been out for 2 months now. So how much longer do you think this is going to take?
>> Um as we said to we um advised Senator Smith, it will take as long as it takes given the process that we have to go through and given that we're looking at compliance with three separate pieces of law. Um and we will move as quickly as we can. Uh we've done a huge amount of work on this investigation to date. We've had significant information provided to us by Optus. We now have the shot report and we will move forward as quickly and expeditiously as we can. The
the new legislation that passed at the end of last year or in November that increased the fines on Telos uh to $30 is that being considered in uh the
No, Senator, my um uh the changes to um to the relevant act which uh sets the penalties for breaches of the emergency call services determination increased the potential penalt civil penalties to $30 million per contravention for contraventions from 31st of October 2025 onwards. So in terms of the 18th of September um the
>> so they get to squib it what's the maximum penalty you can slap on opt for the September 18 outage
>> oh senator that that will be a um function of uh whether we find contraventions and if so then
>> what what what is what is the possible maximum penalty
>> we could only give you what's the net contention
>> yeah so for breaches of the emergency call services determination it was to uh civil penalties of um $250,000 per per contravention.
>> Is that per call that fails? What's a what do you describe a contravention as?
>> So, Senator um the we are looking at Optus's compliance with a range of different provisions in the emergency call services determination. So um that includes their obligation to maintain their networks to be able to carry triple0ero calls to connect calls to transit calls to terminate calls through to the emergency call services determination. Um uh we we look at each of those against um against certainly the calls that failed but um but our focus is not just on those um it it's the broader set of circumstances in there. So um as for where we might land in terms of the number of contraventions in against each of those provisions is still under consideration through our
analysis. um when you've spoken to us before you've um admitted that there were failing failings within ACMA itself uh in relation to the se September 18
um Senator I think what we reflected on was having been given information from OPUS and then having complete radio silence from Optus um for more than 24 hours that our processes should have kicked in um make for um calls into opters to find out what was going on. Um and we've reflected on that. I would say that I think one of the critical changes since that time um has been the establishment of the triple0ero custodian. Um and as they indicated this morning, they're taking a very
>> I understand that real time. Uh my question was actually you have acknowledged that there was failings within ACMA to to be proactive. You you've previously accepted that in this in this committee.
>> The failing that we talked about was that we should have followed up.
>> A lack of pro uh proactiveness. >> You said you were going to review your own practices. Have you done that? And can we have see
went through this last time that we in um reviewed our standard operating procedures. We've and I think we did this through a question on notice from memory. Um and we've reviewed those to make sure there's much quicker escalation processes internally. Um I think also we are working very strongly with the triple0 custodian about their role in finding out information in the first instance and I think that's that is proving to be a significant improvement for all of us.
yesterday's Optus outage that um uh impacted I think it the department said it was about 14,000 customers yesterday. Did OPTIS tell you about that in a timely manner?
>> So I think Senator the um the reference to the 14,000 related to the Apple issue
that affected Telster customers. >> No, it was more like a 100,000 wasn't
it? Uh so Optus' um uh so certainly Optus contacted us as well as the custodian uh at least well certainly we had two separate phone calls. One of those was to me yesterday to let me to let us know um what they were seeing what they were doing about that. So um
>> and so how many how many customers do you understand were impacted?
>> So um we haven't had direct advice from Optus on that at this time. So, I've seen the media reports, but
>> I think the custodian raised that this morning that that was still matters that they were leazing with Optus.
>> Did you ask Optus yesterday when they
>> Um I Yes, I did ask. Um and at the time, the person I was talking to said it was still under um uh that that Optus um the relevant technical staff were working with their partner Ericson to understand what was happening and what the impact was. Um but they were certainly aware that there are a number of um their customers whose devices were going into SOS mode confirmed that that did that meant that that that mode does not affect that users's ability to contact triple0.
>> It's still it's it's still an impact on their their customers though. It the process if 100,000 people are impacted as customers because uh as does that we just think that's a blip or what's the recourse for them? Well,
well, Senator, um, consistent with our role, we will will, um, continue to work with both the custodian and to understand where Optus has got to to make an assessment about whether this raises questions about their compliance with the regulatory framework. And if that um, if that raises concerns, we will open an investigation.
>> And when will we know that? I mean, this happened yesterday. You're in fronting estimates today. I'm just amazed you don't have a bit more information.
Well, well, Senator, at this point in time, we have a limited amount of information. There's certainly nothing in what I heard which causes me to immediately think there has been compliance issues, but there will certainly be further inquiries before we finalize any view around that.
>> Um, can I ask you to take on notice? I'd like to know how many customers uh you understand have been impacted. uh how long they were impacted for and uh what the recourse for customers may be that that service was not available for >> Seeing as they're still being charged >> uh for that service.
>> Senator happy to take it on notice. I'm not sure we had that information at the moment but
>> No, but it's your job to get it. You're the regulator.
>> But we will acquire such information as we can do before we respond to your question on notice.
>> Thank you. Um, Senator Henderson. >> Thank you very much, Uh, Mr. Lachlan, good afternoon. I wanted to ask you about the new SMS sender ID register. Uh, so under the new scheme, businesses are required to register the text sender name with you. Is that correct?
>> That's correct, Senator. And how many
businesses have registered to date?
>> Um, I do have that.
>> I think we do have that data, Senator. Um, I'll just while my colleague is looking for it, um, so we're going through a process of trying to get information out as broadly as possible to all the organizations that we think may need to register um, uh, through the SMSD register. So there's the telecommunication companies themselves. They also uh are looking to communicate with their customers to get them informed. But separately we've been writing for example to all Commonwealth government agencies, all industry associations that we can um uh turn our mind to to raise the awareness that the sender ID will be coming in mid year and to making sure as many um organizations as possible have the opportunity to sign up before the register comes into play.
>> Thank you chair. or I'm also seeking the the how many unique sender names have been approved as well.
>> Yeah, certainly, Senator. Um, so as at the 4th of February, we had 1,163 sender IDs registered across 911 different entities if you like. So, one entity might use more than one sender ID. And we had 1,436 which were in the process like they had been lodged and were being reviewed to see whether they met the conditions for
>> So I understand from an article in the Finn review on the 20th of December last year that the system was supposed to do identity checks before approval was issued by ACMA but the register went live with only a basic setting which required the name and the email address.
Is that correct? So Senator, the register is not live at the moment. It will go live on the 1st of July. What is happening at the moment is the preparatory work to get um the Telos who are responsible for um uh part of the chain to send um SMSs through um onto the system and to get the sender IDs registered so that when the system goes live on the 1st of July all of the settings are in place so that any non-registered sender IDs will not um will not land as well effectively impersonation scams in people's SMS threads.
>> So did the register go live at any point in time?
>> No. No.
>> And so what ID are what ID checks are required before an entity can register?
>> Um do you want >> Yeah.
>> Thank Thank you, Senator. Um the um the rules that the ACMA have have made um require robust um identity uh checks, authentication and uh there are several le levels to this. Um but one is a digital ID check um that establishes the person who is registering uh is who they say they are and that's under um the uh a government program essentially.
>> Can I just cut to the chase here because my understanding is that people were able to register their their name with either a false email or a false name. And after this was reported in the media, it was then corrected. Is that the case?
>> Um, that's correct, Senator. So, um, how you get into the ID register is through a general application that's used across the ACMA called ACMA assist. So, that covers all our licensing and a whole range of other things. Um, and that only had a basic verification process to it for the sender ID register. alongside that there were other very um processes that needed to go through. Uh but it was pointed out to us that um it wasn't requiring documentary uh information which was the intent of it. So we've upgraded the system to require that and um as we've indicated that's well in advance of the system going live. So
anyone could register any name up until you corrected it Mickey Mouse or the like as was pointed out in this article
>> and then people need to reverify. >> So we've gone out to
>> what have you done about those entities or names that have been registered without the appropriate
>> verification? Sorry, Senator, we've gone out to everybody um uh in that ACMA assist process and required that they reverify their
documentation. So, how many fake names were picked up and removed from the register?
>> I I think the the process will be now we've put in place that people need to reverify. That will eliminate those um names on there that aren't verified.
>> But can I just ask, you've corrected the way that people can sign up. You've toughened the ID requirements, the verification requirements. So how many individual names have been removed which were not genuine names or fake
So um so Senator I think um firstly I'd say this was one level of verification once um once uh a user had got through the initial ACMA assist piece before a sender ID could be registered there are additional checks that are built into the system including things like over to the Australian business register um that need to be met before things uh before a sender ID can be registered. Um that said um
>> so is it fair to say that
>> but but hang on a minute there were there were fake names registered. So what I'm trying to understand is >> how many of those fake names have now been removed.
>> Senator, can I just clarify? So the the incident that you were talking about was only about that very basic signup. It did not go through the additional processes that are required.
>> No, I understand that. But given given
believe I don't I certainly don't have the figures with us.
>> No, my understanding is so we're we're also doing an additional level of manual um sort of assurance against any um any IDs that were registered before that change to the level of verification went in place. And we have the powers we need if we um identify that any were any sender ids were um uh fraudulently or erroneously or without the right um the right sort of characteristics registered um registered but we haven't identified any today. It's an ongoing process but we will be checking all of them.
>> Right. So what time frame have you provided to get this right before it goes live.
Well, so Senator, we're certainly um we've done the testing so that we are satisfied that the additional level of identity verification through ACMA assist is in place. That's been there since the 29th of January. Um the team is working through the additional assurance on those matters which came through ahead of that time and that will be it will certainly be completed before the 30th of June when the um when the uh ahead of the register going live on the 1st of July.
>> All right. Could I just ask for a copy of uh any briefings or correspondence in relation to this matter? And I just wanted to also ask if there were any briefings provided to the minister or the department about what's happened here.
>> Um I we were happy to take that on notice. Senator,
>> you don't recall whether you told me?
>> I mean I think we certainly um briefed the department and the minister's office that um we'd been alerted to this issue and what we were what we were doing about it, but we can provide details of that on notice along with the other things you've requested. if you could
provide the details of those any meetings, correspondence, meeting notes, uh, email, correspondence,
>> we'll take that on notice. I think the, um, the issue came up through the media process, um, identified by somebody who had signed on. We met with that person to understand the concerns. So some of this would have been in the context of of us responding to those inquiries, but we're very happy to take your question
on notice. So who in ACMA signed up signed off? Yeah, and I'll be very quick. I'm almost finished. >> Thank you. >> Um, who in Akma signed off on this original setup such that fake names could be registered?
>> Um, Senator, I I will take that on notice. I think it it um it seems to have arisen in an update done some quite considerable time ago from what I remember the circumstance. So I will take that on notice and as I said it it was partly because the the ACMA assist process goes much broader than this. I'm happy to take it on notice and um and respond to your question.
>> So has everything been fixed now? So I understand it was fixed on the 29th of January.
>> The 29th of January fixed the original
>> Okay. So you've now got these addition additional layers of ID verification before anyone can register.
>> That's right. So there's the the the requirement for documentation.
>> If just on notice if you could provide the details of that fix the technical details uh I would be grateful.
>> Of course.
>> Thank you. Thank you very much.
>> Thank you Senator Henderson. Um, on that note, I'm able to say thank you to the officials of Acme. You've taken a number of questions on notice. Um, and there's a time for the return of that, but um, we appreciate your attendance and your evidence here today and the work that sits behind it among I'm sure many of your colleagues as well. Um, I now call officers from the Australian Broadcasting Corporation. I understand they're making their way down, so we will suspend for a minute or two um, while until they're here. Please broadcasting. I now call officers from