Critical

🎯 On-Device & Lawful Access Capabilities

Australia’s investigatory powers framework enables targeted device access and network disruption powers under exceptional warrants. Civil-liberties groups argue oversight must keep pace with vendor capabilities and cross-border procurement.

Investigatory/Assistance Powers
Statutes & Codes
Focus: targeted computer access, assistance notices, interception authorities; judicial oversight and proportionality are critical.
Vendor Ecosystem (mercenary & domestic)
Surveillance Tooling
Risk: capability creep; device compromise beyond intended scope; NDA-shielded procurement.
Critical

📡 Telecom Signalling Exploits (SS7/Diameter/Roaming)

Roaming and interconnect layers can be abused for location tracking and message interception. Mitigations are uneven; coordinated audits and operator attestations are essential.

Carriers & National Cyber Guidance
Telecom/Network Security
Focus: signalling firewalls, anomalous global-title traffic, threat intel sharing, independent testing.
Moderate

📱 Cell-Site Simulators (IMSI-catchers)

Use by law-enforcement bodies has been reported, with procurement often shielded. Risks include dragnet capture and retention of bystander identifiers.

IMSI-catcher Deployments
Law Enforcement Capability
Safeguards needed: warrant standard, purge of non-targets, transparency reporting.
Critical

🗂️ Data-Broker & Adtech Exposure

Retail, app-SDK, and adtech flows can reveal sensitive locations and behavioural profiles. Regulatory findings highlight consent defects and opaque downstream use.

Consumer & Location Data Markets
Brokers/Platforms
Risk: sensitive-site visitation inference; bulk audience creation; resale to public and private buyers.
Regulatory Actions & Guidance
Privacy/OAIC + State Regulators
Focus: consent standards, overseas disclosures, deletion rights, DPIAs for high-risk processing.
Moderate

📺 Platform Governance & Online Safety

Online-safety and misinformation regimes impose duties on platforms. Transparency around government requests and algorithmic curation remains necessary to limit informal pressure.

eSafety/Platform Codes
Regulatory Schemes
Focus: risk assessments, reporting windows, child-safety design, appeals pathways.

🕸️ Corruption Network Visualization (Australia)

Relationships between spyware vendors, data brokers, telecoms, platforms, and AU authorities. Drag nodes to explore.

Legend: ● Authorities ● Vendors ● Brokers ● Platforms ● Telecom/Programs

🔗 Key Relationships (AU)

Investigatory powers ↔ vendor ecosystem

Core: Targeted device/network access ↔ mercenary/domestic tools ↔ procurement oversight & NDA constraints.

Telecom signalling & roaming

Core: SS7/Diameter interconnect ↔ global-title and roaming exposure ↔ carrier mitigations & audits.

Data-broker ↔ platform loop

Flow: Apps/SDKs/Retail → aggregators → adtech & public buyers; consent/disclosure compliance monitored by regulators.

📅 Signal-Power Evolution Timeline (Australia)

Metadata & interception regimes

Retention and interception frameworks establish baseline access powers across agencies and carriers.

Assistance & access powers

Targeted computer-access and technical-assistance mechanisms created; debate on encryption and systemic risk intensifies.

Platform governance & online safety

Codes, standards, and regulator guidance phase in; transparency and due-process measures contested.

Signal-layer scrutiny

Roaming/interconnect audits and incident reporting expand; cross-border abuse becomes a focus.

⚡ Immediate Stop-Gap Actions (AU-aligned)

Drafted to dovetail with AU investigatory-powers and privacy regimes while constraining “signal-power” abuse.

🛡️ Spyware/High-Risk Tools
  1. Judicial authorization + necessity/proportionality for invasive tools (ODIT/spyware).
  2. Public DPIA within 30 days of program start; quarterly aggregate reporting (vendor, legal basis, categories).
  3. Vendor NDAs unenforceable against courts, inspectors-general, and privacy regulators.
📡 Signalling/Interconnect Hardening
  1. Carrier attestations on SS7/Diameter defences and roaming-edge audits; annual third-party testing with public summaries.
  2. Incident statistics and corrective action logs; publishable without compromising active ops.
🗂️ Data-Broker Containment
  1. No acquisition of location/behavioural datasets absent lawful basis and minimization plan.
  2. Public broker relationship log; deletion audits; direct-marketing conformance under privacy/telecom rules.
📱 IMSI-catcher Governance
  1. Warrant standard; purge attestations for non-targets; capability summaries and annual oversight review.
📺 Platform Governance
  1. Documented systemic-risk logs; “no informal pressure” policy with auditable legal bases for requests.
  2. Child-safety design and transparency measures per online-safety regimes.

📋 Implementation Toolkit (Model Resolution / By-law)

Edit inline; then copy or download. Language aligns with AU frameworks and telecom/online-safety contexts.