New ZealandTelecommunications (Interception Capability and Security) Act 2013, Network Security
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.legislation.govt.nz/act/public/2013/0091/latest/096be8ed81fac9cc.pdfIn force since .
A sector security regimes rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security, Governance
As of .
What it requires
- This binds a network operator, being a person who owns, controls or operates a public telecommunications network or who supplies, by wholesale or retail, another person with the capability to provide a telecommunications service (reached by declaring that you provide telecommunications services).
- Engage with the Director of the Government Communications Security Bureau as soon as practicable after you become aware of any network security risk that may arise if a proposed decision, course of action or change is implemented, act honestly and in good faith when you do, and give the Director access to the employees, contractors or agents best placed to assist (section 46).
- Notify the Director of any proposed decision, course of action or change regarding the procurement or acquisition of equipment, a system or a service in an area of specified security interest (network operations centres, lawful interception equipment or operations, and parts of the network that manage or store aggregated customer information or administrative credentials), or any change to its architecture or to its ownership, control, oversight or supervision, before you approach the market or during the development of the change proposal and in time for the Director to act (section 48).
- Do not implement a proposed decision, course of action or change that the Director has advised would raise a network security risk other than a minimal one, until a proposal accepted by the Director, a Ministerial direction or the Director's decision not to refer the matter allows it, respond in writing as soon as practicable with a proposal to prevent or mitigate the risk, and implement the parts of the proposal the Director accepts (sections 51 to 53).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
Section 98(1) caps a pecuniary penalty at $500,000. For a continuing contravention of a compliance order the High Court may add a further penalty of $50,000 for each day or part of a day (section 98(2)).
- Rule
- Fixed only
- As of
- Currency
- NZD
- Fixed cap
- 500,000
Who enforces it
Enforcement body
The Director of the Government Communications Security Bureau administers Part 3, and a surveillance agency may apply to the High Court for a compliance order or a pecuniary penalty order for a serious breach.
Settledness
- As of
- Open questions
- Which additional areas of specified security interest has the Governor-General prescribed by Order in Council under section 47(2), if any?
What this law does
Section 45 of the Telecommunications (Interception Capability and Security) Act 2013 applies Part 3 to network operators. Section 3(1) of the Act defines a network operator as a person who owns, controls or operates a public telecommunications network or who supplies, by wholesale or retail, another person with the capability to provide a telecommunications service.
Section 46(1) of the Act requires a network operator to engage with the Director of the Government Communications Security Bureau as soon as practicable after becoming aware of any network security risk that may arise if the proposed decision, course of action or change is implemented.
Section 47(1) of the Act lists network operations centres, lawful interception equipment or operations, and any part of a public telecommunications network that manages or stores aggregated customer information or authentication credentials among the areas of specified security interest.
Section 48(1) of the Act requires a network operator to notify the Director of any proposed decision, course of action or change regarding the procurement or acquisition of equipment, a system or a service within an area of specified security interest, or a change to its architecture, ownership, control, oversight or supervision. Section 53 of the Act requires the network operator to implement those parts of a proposal to address a network security risk that the Director has accepted.
Section 98 of the Act caps a pecuniary penalty for a serious breach of the Act's duties at $500,000. Section 91(3) of the Act allows only a surveillance agency to apply for a compliance order or a pecuniary penalty order. Section 2(2) of the Act brings Part 3 into force on the date that is 6 months after the date on which the Act receives the Royal assent. The Act has a date of assent of .
When LexLint raises it
When your app profile says your app provides telecom services.