Division 7—Limitations
317ZG Designated communications provider must not be requested
or required to implement or build a systemic weakness or
systemic vulnerability etc.
(1) A technical assistance request, technical assistance notice or
technical capability notice must not have the effect of:
(a) requesting or requiring a designated communications
provider to implement or build a systemic weakness, or a
systemic vulnerability, into a form of electronic protection; or
(b) preventing a designated communications provider from
rectifying a systemic weakness, or a systemic vulnerability,
in a form of electronic protection.
(2) The reference in paragraph (1)(a) to implement or build a systemic
weakness, or a systemic vulnerability, into a form of electronic
protection includes a reference to implement or build a new
decryption capability in relation to a form of electronic protection.
(3) The reference in paragraph (1)(a) to implement or build a systemic
weakness, or a systemic vulnerability, into a form of electronic
protection includes a reference to one or more actions that would
84
Telecommunications and Other Legislation Amendment (Assistance
and Access) Bill 2018
No.
 , 2018
317ZGANo.
Industry assistance Schedule 1
Amendments Part 1
render systemic methods of authentication or encryption less
effective.
(4) Subsections (2) and (3) are enacted for the avoidance of doubt.
(4A) In a case where a weakness is selectively introduced to one or more
target technologies that are connected with a particular person, the
reference in paragraph (1)(a) to implement or build a systemic
weakness into a form of electronic protection includes a reference
to any act or thing that will, or is likely to, jeopardise the security
of any information held by any other person.
(4B) In a case where a vulnerability is selectively introduced to one or
more target technologies that are connected with a particular
person, the reference in paragraph (1)(a) to implement or build a
systemic vulnerability into a form of electronic protection includes
a reference to any act or thing that will, or is likely to, jeopardise
the security of any information held by any other person.
(4C) For the purposes of subsections (4A) and (4B), an act or thing will,
or is likely to, jeopardise the security of information if the act or
thing creates a material risk that otherwise secure information can
be accessed by an unauthorised third party.
(5) A technical assistance request, technical assistance notice or
technical capability notice has no effect to the extent (if any) to
which it would have an effect covered by paragraph (1)(a) or (b).
Limits on technical capability notices
(1) If:
(a) a designated communications provider supplies a particular
kind of telecommunications service; and
(b) the service involves, or will involve, the use of a
telecommunications system;
a technical capability notice has no effect to the extent (if any) to
which it requires the provider to ensure that the kind of service, or
the system:
(c) has the capability to enable a communication passing over
the system to be intercepted in accordance with an
interception warrant; or
, 2018
Telecommunications and Other Legislation Amendment (Assistance
and Access) Bill 2018
85
SchedulePart1 Industry assistance
1 Amendments
(d) has the capability to transmit lawfully intercepted
information to the delivery points applicable in respect of that
kind of service; or
(e) has a delivery capability.
NoteNote1:
2:
Part 5-3 of the Telecommunications (Interception and Access) Act
1979 deals with interception capability.
Part 5-5 of the Telecommunications (Interception and Access) Act
1979 deals with delivery capability.
(2) For the purposes of subsection (1), ensuring that a kind of service
or a system has a particular capability includes ensuring that the
capability is developed, installed and maintained.
(3) A technical capability notice has no effect to the extent (if any) to
which it requires a designated communications provider to keep, or
cause to be kept:
(a) information of a kind specified in or under section 187AA of
the Telecommunications (Interception and Access) Act 1979;
or
(b) documents containing information of that kind;
relating to any communication carried by means of a service to
which Part 5-1A of the Telecommunications (Interception and
Access) Act 1979 applies.
Note:
Part 5-1A of the Telecommunications (Interception and Access) Act
1979 deals with data retention.
(4) A technical capability notice has no effect to the extent (if any) to
which it requires a designated communications provider to keep, or
cause to be kept, information that:
(a) states an address to which a communication was sent on the
internet, from a telecommunications device, using an internet
access service provided by the provider; and
(b) was obtained by the provider only as a result of providing the
service.
Note:
This subsection ensures that a technical capability notice cannot
require a designated communications provider to keep information
about subscribers’ web browsing history.
86
Telecommunications and Other Legislation Amendment (Assistance
and Access) Bill 2018
No.
 , 2018
Industry assistance Schedule 1
Amendments Part 1
(5) An expression used in this section and in Chapter 5 of the
Telecommunications (Interception and Access) Act 1979 has the
same meaning in this section as it has in that Chapter.