Public network maps a security risk: telcos

Telstra and Optus say a proposal by the Australian Competition and Consumer Commission (ACCC) to publish infrastructure location information could be a risk to security.

In April this year, the ACCC invited comment on the possibility of changing the record keeping rules (RKR) surrounding telecommunications infrastructure locations. The discussion paper requested comment on whether the information held by the ACCC should be made public or just made available to a limited audience, whether the disclosure of this information would promote competition in the industry, and how often it should be kept up-to-date.

Telstra said in its response to the discussion that only limited infrastructure information should be published to carriers and carriage service providers and should not be given to the general public. For commercial reasons, Telstra said the name of the carrier that owns a specific piece of infrastructure should not be disclosed. For security reasons, it believed that the precise locations of infrastructure should remain private.

"It is vital not to underestimate or discount the national security implications the disclosure of certain telecommunications network information could bring," Telstra said. "International events of the last 10 years demonstrate it is not inconceivable that persons — both within Australia and overseas — determined to assault the public health and safety of Australian people and institutions, could access publicly available certain telecommunications network information to precisely identify points of access to the network."

"This could reasonably enable such persons to attempt to disable or disrupt telecommunications (nationally and internationally) and security systems for sensitive installations, such as banks, government agencies, utilities, air, road and rail transport and traffic control systems."

In its submission, Optus appeared to be in agreement with Telstra, stating that the ACCC should only publish backhaul infrastructure information to a limited audience, with location-specific information kept even more secure to reduce the risk of misuse.

"There appears to be little value in informing the public where the access fibres are located," Optus said. "Further, Optus is concerned that publishing such information to the public may increase the possibility of vandalism."

Optus said the ACCC had not made clear what infrastructure information it proposed to publish and said that much of the information about Optus' mobile and DSL infrastructure was already in the public domain. Optus noted that disclosing information about the location of broadband infrastructure in the future would not be relevant with the upcoming roll-out of the National Broadband Network, meaning no telco would be putting in any new network.

Vodafone Hutchison Australia (VHA) had fewer objections to the proposal, but regulatory general manager Brian Currie stated in his response that because VHA provides 2G and 3G coverage maps to the public already, there is no need for the ACCC to publish VHA information in the infrastructure RKR. In addition to this, Currie said that since VHA keeps more up-to-date information than the infrastructure RKR, the ACCC should review whether the RKR should apply to VHA at all.

Fibre-optics network provider Pipe Networks said it opposed any disclosure of infrastructure information.

"Although Pipe agrees that there is a lack of competition in many backhaul markets, Pipe believes that this lack of competition is attributable to market forces and not to information asymmetries which might be corrected by the disclosure of infrastructure RKR data," Pipe said. "Pipe respectfully disagrees with the ACCC's views that disclosure of infrastructure RKR data would promote competition and, in any event, submits that other factors including the harm to the legitimate commercial interests of competitors and the public interest weigh strongly against disclosure."

David Forman, executive director for Competitive Carriers' Coalition (CCC), wrote in his submission that such protection of the information as called for by Telstra and Optus would become too time consuming for the ACCC to maintain.

"Limiting disclosure involves defining and identifying the limited audience and putting in place security arrangements to ensure that the information is confined to that audience," he said. "The CCC considers that in the present case, such measures add unnecessary complexity and administrative burden to the task of disclosure and as such are not warranted."

Forman argued that all infrastructure information disclosed should be in an aggregated format that didn't disclose the operator of each specific piece of infrastructure. He also said the ACCC should further consult with the industry before moving ahead with any plans.