House of Representatives – Telecommunications Amendment (SMS Sender ID Register) Bill 2024 – Second Reading Debate

Ms ROWLAND (Greenway—Minister for Communications) (09:35): I move:

That this bill be now read a second time.

The Telecommunications Amendment (SMS Sender ID Register) Bill 2024will amend the Telecommunications Act 1997 to require the Australian Communications and Media Authority to establish and maintain an SMS sender ID register.

The bill gives direct effect to the government's decision to provide the ACMA with funding to establish and run a SMS sender ID register.

The register aims to protect consumers and brands by disrupting a specific type of SMS impersonation scam—where scammers send SMS sender IDs to imitate well-known brands such as banks, government agencies or retailers in order to deceive victims.

It's hard to imagine an Australian who has not received one of these text messages purporting to be from a bank or a toll road operator, for example. These fraudsters operate domestically and overseas and use sophisticated technologies to trick innocent Australians into divulging sensitive information in order to steal their money or personal information. The financial losses, psychological damage and general annoyance suffered is immense.

SMS is now the most frequently reported contact method for scams, and almost $27 million was lost to scams in 2023, as reported to Scamwatch. Of course, not all scam losses are reported, so the real cost is far greater.

The government has made significant progress in combatting scams. Data released by the ACCC in April 2024 indicates estimated scam losses were down 13.1 per cent in 2023 from 2022.

However, while losses have decreased and progress is being made, Australians are still losing too much. There is no 'silver bullet' to eliminate scam activity; scammers will invariably adapt and utilise new methods to contact would-be victims.

The formal creation of this register will bolster existing anti-scam measures. Once operational, this register is designed to:

decrease the frequency and impact of SMS impersonation scams on consumers;

increase protections for legitimate brands and agencies against bad actors impersonating them;

disrupt the business models for SMS impersonation scams;

restore public confidence in SMS as a communications channel; and

ultimately, make Australia a harder target for scam activity.

A pilot register has been operating since December 2023, which has generated valuable insights.

Whether the register will ultimately be a voluntary or mandatory model is yet to be determined and is notthe focus of this bill. That decision is scheduled for later this year. It will be informed by detailed costings and analysis as well as the two rounds of stakeholder and public consultation in 2023 and 2024.

Following that decision, corresponding rules will be made to bind the relevant parts of the industry to certain obligations. This mechanism does not feature in the bill and will be effected by existing powers in the Telecommunications Act 1997.

The main elements of the bill are:

A requirement for the ACMA or a contracted service provider (on its behalf) to establish the register; and a requirement for the ACMA or for a contracted service provider (on its behalf) to maintain all or some of the content of the register.

The register will be a register of sender identifications that have been accepted by the ACMA. The bill sets out a two-step registration process specifying how entities may apply to the ACMA for approval to register before applying to register one or more sender identifications.

The bill allows for a deferred commencement date that will commence on a day to be fixed by proclamation. However, if the provisions do not commence within a period of six months beginning on the day the act receives the royal assent, they would commence on the day after the end of that period. This recognises that the ACMA will require time to finalise technical and operational aspects for the register which is likely to be a complex ICT solution platform together with instruments that must be prepared to complete the framework. Accordingly, this bill provides that the ACMA must establish the register 'as soon as practicable'. The bill defines what is meant by a sender identification and will also provide the Minister for Communications with the authority to determine, by legislative instrument, other communication services (beyond SMS and multimedia messaging service) which employ sender identifications that may be registered in the future and other things that may feature in a sender identification.

The essential elements for applications, refusal of applications, prevention of impersonation of sender identifications (or spoofing) and removal of entries from the register are explicitly embedded in the bill; however, new powers will be conferred on the ACMA to make determinations, by legislative instrument. These will set out further requirements for access to the register, and its administration and operation. The use of subordinate legislation to specify these requirements will be critical in allowing functional aspects of the register's operation to be adjusted over time to accommodate both changes in technology and services that may be part of the register in the future. It will also mean the ACMA can respond appropriately to changes in scammers' behaviour, while providing ongoing protection to legitimate entities and consumers.

The bill provides for hybrid decision-making, where decisions based solely on objective criteria can be made by computer programs arranged by the ACMA while decisions requiring evaluative judgments are required to be made by a human. The bill includes a number of measures to mitigate any risks associated with automated decisions—such as the power for the ACMA to substitute decisions and remove an entry from the register when necessary.

This government has made significant inroads combating telecommunications scams but is committed to doing more. This bill is the next formal step in creating a SMS sender ID register, which, once fully operational, will offer better protection for consumers and increase brand protection for legitimate businesses and entities using SMS sender identifications.

Debate adjourned.