Why does a phone company store a customer’s passport number?
Companies should only collect data that they really need. One way to encourage this behavior is to punish them when a breach happens based on the amount of data they collect.
A data breach on a service that only has an email address on it matters a lot less to me than one that has my name, phone, address or picture of my id.
Collecting and keeping this data is a regulatory requirement for Optus.
The problems with this breach have their roots in how identity is proven and verified in Australia. Far too much relies on possession of a physical document.
Here are the ID requirements for their major competitor, Telstra: https://www.telstra.com.au/support/account-payment/id-check-...
These are legislated: https://www.legislation.gov.au/Details/F2022L00548
That doesn’t stop these companies just going for the big ID though, and for postpaid they are offering credit and will definitely require 100 points of ID.
The ACMA determination is pretty hard to parse unfortunately.
https://www.comparitech.com/blog/vpn-privacy/sim-card-regist...
US Senate tried to pass a similar law back in 2010. Bill sponsors were Chuck Schumer and John Cornyn, in case you ever see those names on your ballot.
Then they detained an innocent person for the longest time without charge in recent history, including solitary for 23 hours per day, and not letting him access legal advice or contact his family, because terrorism.
These are all really good questions.
Knew a guy who used to work for Optus, he said their business SIP service was constantly getting hacked and their strategy for dealing with it was just to eat the losses and give out account credit like water, because their infrastructure was so outdated and poorly designed that it was functionally impossible to secure.
Honestly, Ausgov should rip Optus to shreds for this... not only for the data breach specifically, but also as a critical infrastructure operator they should be held to a far far higher standard than an ordinary business.