Feeds

Australia's de-facto net filter has ZERO regulation

Work starts on approval process and oversight for web-ban law

Combat fraud and increase customer satisfaction

Updated A couple of weeks back, Australia's Securities and Investment Commission (ASIC) made a mistake: by trying to take down a Website promoting an investment scam*, it accidentally blocked 1,200 sites using the same IP address as the scammer.

ASIC was able to attempt the take down thanks to a "Section 313 Notice", a legislative instrument that instructs telcos and ISPs to block sites that break Australian laws.

It has now emerged that there is little or no oversight or transparency in how such notices are issued, who's allowed to request one or when they're permitted to make such requests. That means, as a Senate Estimates hearing was told, that nobody really knows exactly how many agencies might have the right to use the notices to, as Greens Senator Scott Ludlam put it, “knock a site off the Internet”.

A “Section 313 notice” refers to this section of the Telecommunications Act. The act requires carriers to try and prevent their networks being used to commit offenses, and requires them to assist an undefined list of “officers and authorities” of the Commonwealth, states and territories in preventing crimes using their networks.

Unfortunately, when the legislation was framed, the legislators had in mind telephones and fax machines, not the Internet. Its application to the Internet was the brainchild of Senator Stephen Conroy, as a way to implement the Interpol "worst of the worst" Internet blacklist (which mainly concerns child pornography) without having to pass new legislation.

While Senator Conroy stated to Estimates that the Australian Federal Police's use of s313 notices in this way has been effective, the s313 notice has become an example of scope creep, with other agencies getting in on the act.

The new problem turned up by Senator Ludlam is this: neither communications minister Senator Stephen Conroy nor his department are completely certain regarding how many Australian government agencies might have the power to request s313 notices. The horizon of the notices' scope is an unknown.

Following a meeting convened by on May 22, 2013 and attended by a number of departments – including the Attorney-General's Department, ACMA, ASIC, the AFP, the Department of Immigration, ASIO and others – Senator Conroy told Estimates that the government will set in train a process to improve the transparency surrounding the use of s311 notices.

The problem, as Ludlam revealed in questioning the minister and his department, lies in the definition of why notices may be sought. Since law enforcement is on the list, he asked whether it might reach all the way down to state police services; and since the “protection of public revenue” is offered as a reason for seeking a notice, he also asked whether the power might extend all the way down to local government (since they collect rates).

That question has had to be taken on notice by the Department of Broadband Communications and the Digital Economy (DBCDE), which Conroy heads.

As of much concern, the DBCDE was also unable to say whether s313 notices had already been used by state agencies, nor how many times they might have been used outside the purview of the federal government. Again, that question had to be taken on notice.

“I've asked the department to provide advice on a number of possible transparency measures,” Conroy said. “I agree … that there needs to be a greater degree of transparency.”

It is, perhaps, a small reassurance that the notices at least don't reach as far as copyright matters. Perhaps. Maybe. When Senator Ludlam asked whether a rights-holder could ask the police to seek a s313 notice, Senator Conroy responded: “I doubt that an individual citizen can walk in [into a police station - El Reg] and ask for a 313.” ®

*Bootnote: The back story is that ASIC requested a block on a site based on the site's IP address. Of course the target was on a shared server, so of course it blew away a whole heap of harmless sites, leading to a public outcry and embarrassment all round. “My lord, I 'ave a cunning plan” is never a good way to approach law enforcement. ®

Update:

Australian Securities and Investment Commission chair Greg Medcraft has reportedly told a Sydney conference his organisation will review its use of the s313 notices.

He said the notices had been used ten times in the last 12 months to bar access to Websites promoting frauds and scams, and that most of these are overseas. ®

SANS - Survey on application security programs

More from The Register

next story
Android engineer: We DIDN'T copy Apple OR follow Samsung's orders
Veep testifies for Samsung during Apple patent trial
MtGox chief Karpelès refuses to come to US for g-men's grilling
Bitcoin baron says he needs another lawyer for FinCEN chat
Did a date calculation bug just cost hard-up Co-op Bank £110m?
And just when Brit banking org needs £400m to stay afloat
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Don't let no-hire pact suit witnesses call Steve Jobs a bullyboy, plead Apple and Google
'Irrelevant' character evidence should be excluded – lawyers
EFF: Feds plan to put 52 MILLION FACES into recognition database
System would identify faces as part of biometrics collection
Ex-Tony Blair adviser is new top boss at UK spy-hive GCHQ
Robert Hannigan to replace Sir Iain Lobban in the autumn
Alphadex fires back at British Gas with overcharging allegation
Brit colo outfit says it paid for 347KVA, has been charged for 1940KVA
Jack the RIPA: Blighty cops ignore law, retain innocents' comms data
Prime minister: Nothing to see here, go about your business
Banks slap Olympus with £160 MEEELLION lawsuit
Scandal hit camera maker just can't shake off its past
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.