Thank you, dear reader, for clicking through to the fourth article of Hardcoded, my series on the emergency camp on functionality of mobile phones used in Australia, that is, their ability to dial emergency service numbers like 000 when their usual telecom network is unavailable. I abbreviate this to ‘camp on’.
I provided a dash of context for this telecommunications policy fiasco in the Prologue.
I went through the technicalities of making (emergency) voice calls over a 4G network and what went wrong with Samsung’s wares in my second piece.
In that one, I distinguished between:
61 ‘Updatable Models’—that Samsung said could be fixed through over-the-air firmware updates; and
10 ‘Hardcoded Models’—that Samsung said could not be fixed and thus required replacement.
In my third article, I provided an overview of the tragic fallout of this utter debacle.
In the present piece, I will go through the regulatory landscape vis-à-vis telcos and phone manufacturers when it comes to the 000 capability of mobile phones used in Australia.
Before I do so, I must, however, offer a definition of regulation.
While there remains an absence of consensus on such a definition, I prefer the words of Professor Julia Black, scholar of regulatory theory (emphasis added):
regulation is the sustained and focused attempt to alter the behaviour of others according to defined standards or purposes with the intention of producing a broadly identified outcome or outcomes, which may involve mechanisms of standard-setting, information-gathering and behaviour-modification.
As you can see, this definition does not limit regulation to something done by a particular stakeholder like the state or through any particular regulatory tool like a legal instrument. It is a holistic, multi-stakeholder definition, which is relevant for our purposes as we look at stuff like industry codes later on in this article.
Having defined regulation, I shall now outline how our laws define different types of telcos.
Carriers v Carriage Service Providers
Under the primary federal telecommunications law over here, the Telecommunications Act 1997 (Cth) (‘Telecommunications Act’), there is a critical legal distinction between telcos that are ‘carriers’ versus telcos that are ‘carriage service providers’.
Carriers are entities that operate telecommunications equipment (‘network units’: section 42) as per a ‘carrier licence’ (sections 42, 56) or under a ‘nominated carrier declaration’ for that equipment (sections 42, 81) from our federal telecommunications regulator, the Australian Communications and Media Authority (‘ACMA’). Here’s the ACMA’s register of carrier licences and nominated carrier declarations.
Carriers themselves operate or permit others (‘carriage service providers’: section 87) to operate those network units to provide ‘a service for carrying communications by means of guided and/or unguided electromagnetic energy’ to the public (‘carriage service’: sections 42, 87). To be precise, carriage service providers supply, or propose to supply, ‘listed carriage services’ (defined in section 16) to the public using network units owned by ≥ 1 carrier or network units that are subject to nominated carrier declarations (section 87).
Carriers include Optus, Telstra and TPG Telecom. Each of these are also carriage service providers.
Firms that are only carriage service providers include Amaysim (for which Optus is the carrier) and Lebara (for which TPG Telecom, the owner of the Vodafone brand in Australia, is the carrier).
Alrighty, with that scene-setting out of the way, let’s look at the obligations of the telcos with respect to dud phones under Command and Control regulation, that is, regulatory frameworks that constitute direct intervention by the state through the force of law.
Command and Control
ECS Determination
Under the auspices of the Telecommunications Act, a key bit of law is the Telecommunications (Emergency Call Service) Determination 2019 (Cth) (‘ECS Determination’), which has been issued by the ACMA.
As the name of the instrument suggests, it is designed to ensure that people in Australia can successfully dial emergency service numbers when they need help from emergency services (see also the objects clause, section 5).
Just some further context:
The general emergency service number here is 000 (the one I focus on in Hardcoded), while 106 is the one for use with teletypewriters and 112 is an alternative number for mobile phone users, as per Telecommunications Act s 466(2) and Telecommunications Numbering Plan 2025 (Cth) s 20 (the latter was issued by the ACMA).
An ‘emergency call service’ handles calls to emergency service numbers and ensures that emergency services are dispatched when and where they are required (to summarise the definition in the Telecommunications Act s 7). The ACMA oversees emergency call services in Australia, as per part 8 of the Telecommunications (Consumer Protection and Service Standards) Act 1999 (Cth).
Australia’s largest telco, Telstra, runs the emergency call service for which 000 and 112 are emergency service numbers. That is, it is the ‘emergency call person’ for those numbers as per the Telecommunications (Emergency Call Persons) Determination 2019 (Cth) s 7 (‘ECP Determination‘) and ECS Determination s 6. (For the sake of completeness, I note that the emergency call person for 106 is Concentrix Services, as per the ECP Determination ss 4, 8 and ECS Determination s 6.)
Now, with that further scene-setting done, let’s return to the ECS Determination.
The chunk thereof which is especially relevant for our purposes is part 4 which commenced on 28 October 2024. This obliges carriage service providers to:
identify any mobile phones connected to their networks that aren’t/are no longer configured to access ‘the emergency call service’ (‘ECS’, which I assume here to mean the one for 000 and 112), whether via the providers’ own networks or those of other providers: sections 64(2), 66(2), 68;
notify the end-users of those phones that their devices aren’t/are no longer configured to access the ECS (notification obligations vary by whether the end-users are customers and if the devices can no longer access the ECS): sections 65(2)(a), 67(2)(a), 69(2)-(3);
block those phones from their networks (blocking timeframes vary by whether the end-users are customers): sections 65(2)(b), 67(2)(b), 69(4); and
inform the end-users of those phones about alternative devices, including low/no cost ones that can access the ECS: sections 65(2)(c), 67(2)(c), 69(5). The providers must also ensure they provide for ≥ one way for customers doing it tough to get help in obtaining low/no cost phones that can access the ECS: section 70.
Note that the notification, blocking and alternative device information obligations don’t apply in relation to a phone (as per section 71):
used by a ‘foreign traveller’ intending to stay in Australia ≤ 90 consecutive days; and
to which the carriage service provider ‘has sent a notification … to the effect that the mobile phone is not configured’ to access the ECS.
I add that carriers are required to ‘do everything reasonably necessary to ensure that’ carriage service providers that use said carriers’ mobile networks can comply with their obligations under the ECS Determination part 4: section 63.
So, these are the obligations for the telcos.
What about the obligations of OEMs like Samsung?
TLN
The relevant regulatory instrument issued by the ACMA is the Telecommunications (Labelling Notice for Customer Equipment and Customer Cabling) Instrument 2025 (Cth) (‘TLN’). Note that the obligations I outline below apply to both phone manufacturers and importers. I’ll focus, however, on those obligations applying to the former, given the nature of this series.
In essence, a manufacturer has to:
get their product tested against applicable technical standards that are defined regarding mobile phones in sections 6(1), 9. They include the Telecommunications (Voice Performance Requirements for Customer Equipment – AS/CA S004) Technical Standard 2025 (Cth), which was issued by the ACMA; Telecommunications (Mobile Equipment Air Interface) Technical Standard 2022 (Cth), issued by the ACMA; and AS/CA S042.1:2025 Requirements for Connection to an Air Interface of a Telecommunications Network – Part 1: General), issued by the Australian Telecommunications Alliance;
apply a ‘compliance label’ to the product to indicate that it meets said standards: sections 11, 13. The compliance label must be in the form of the RCM (‘regulatory compliance mark’, pictured below), namely the triangle enclosing a tick, or a QR code/similar ‘if the relevant link is to information on a website that displays the RCM prominently’: sections 6(1), 12(1), schedule 3;
(If the product doesn’t meet said standards, the manufacturer must, as per part 3 divisions 4-5: stick a ‘non-compliance label’ on the packaging and in accompanying documentation; and prepare a written statement listing the standards that the product doesn’t meet and which the manufacturer must retain);
complete a ‘declaration of conformity’ in relation to the product, which includes ‘a statement that the declarant is reasonably satisfied, having had regard to particular documents, that the item complies with each applicable technical standard in relation to the item’: section 22. That reasonable satisfaction is defined in section 22(4), basically, in terms of ‘the test results say so and you had a look at the test results’;
prior to supplying the product, register themselves on the EESS Platform: sections 20-1. That is the ‘national database’ defined in TLN s 6(1) and Radiocommunications Equipment (General) Rules 2021 (Cth) s 57; and
retain certain compliance records (as per sections 26-7 and including the declaration of conformity) for the period specified in section 28 (eg two years after the product is supplied).
The ECS Determination and TLN are practically implemented through co-regulation, a type of regulation whereby regulated entities regulate themselves with the state overseeing and/or ratifying that regulation.
In the immediate context, this means two codes developed by the Australian Telecommunications Alliance (‘ATA’). Previously called the Communications Alliance, the ATA is the peak body for the telecommunications industry here, and has members including phone and networking equipment manufacturers, carriers, carriage service providers and law firms.
The ATA is also recognised under the Telecommunications Act pt 6 as ‘a body responsible for the development of industry codes’. These co-regulatory instruments are registered under part 6 of the Telecommunications Act (here’s the full list on the ACMA’s website).
Let’s have a look at two relevant ones.
Co-Regulation
ECS Code
First up, we have the C536:2020 Emergency Call Services Requirements (Incorporating Variation No.1/2025) Industry Code (‘ECS Code’) which concerns the day-to-day running of ECSes in Australia.
This seeks to ensure (as per clause 1.4):
that everyone can connect to an ECS (such as that for 000);
the actual implementation of the ECS Determination;
that telcos’ obligations ‘are clearly documented and understood’;
that relevant parties communicate effectively when technical issues arise; and
the promotion of the public’s understanding and appropriate use of ECSes.
While the ECS Code can be argued to be an overarching 000 industry code, what is more directly relevant for a series on problematic firmware configurations in Samsung phones is the industry code which governs device testing.
Enter the C674:2025 Emergency Calling – Network and Mobile Phone Testing (‘Testing Code’).
Testing Code
Essentially, the Testing Code governs the, you guessed it, testing of whether handsets will actually be able to access an ECS on the networks of ‘Nominated Mobile Network Operators’ (‘Nominated MNOs’) in the event of ‘various network test failure scenarios’.
Nominated MNOs are telcos requested by the hosts of ‘Controlled Test Facilities’ (‘CTF Hosts’) to participate in six-monthly independent testing of mobile phone and network performance as well as failure scenarios in controlled radio frequency settings.
During a testing period, certain phone models will be selected for testing in a CTF, with the results to be sent off to: the Nominated MNOs; ‘Equipment Suppliers’ (eg phone OEMs, networking equipment vendors) whose customer equipment was tested; the ACMA; and the Department of Infrastructure, Transport, Regional Development, Communications, Sport and the Arts (again, yes, that is the real name).
Note also clause 3(c) which declares that the Testing Code (emphasis added):
is not a replacement for the required Mobile Phone certification testing for applying the RCM label, rather it is using selected Mobile Phones to perform end-to-end ecosystem testing in a controlled test environment.
This underlines how the Testing Code is a co-regulatory instrument under, and indeed complementing, black-letter law like the Telecommunications Act and the TLN.
As of writing, the Commonwealth has contracted the University of Technology Sydney to establish a CTF and act as a CTF Host.
The Testing Code was enacted in October 2025 while the first round of testing was anticipated to commence in November.
Big Picture
All bar one of the above regulatory instruments apply to the telcos, be they carriers, carriage service providers or Mobile Network Operators, not the phone manufacturers.
On the flip side, the TLN is arguably the only and most direct regulation of the product development practices of the manufacturer. It comprises a combination of Command and Control regulation (the specific things that the manufacturer has to do like applying the RCM to a compliant phone), as well as performance-based regulation (the specific outcomes that the manufacturer must achieve regarding the phone, including that the latter is compliant with applicable technical standards).
Given the nature of performance-based regulation, phone manufacturers like Samsung are left to their own devices (I apologise for nothing) to figure out how to ensure their phones are compliant with said standards.
The TLN is not concerned with, for instance, Samsung’s commercial decision to prevent its phones from being network agnostic for dialling emergency service numbers on 4G networks. Something which I reckon was a key factor behind the camp on fiasco.
Rather, the TLN is concerned with whether Samsung can show its phones comply with the relevant standard mandating that phones can access the ECS for 000 and 112.
Is this ideal? Shouldn’t there be a way, by law and/or industry consensus, to ban phones that aren’t configured to be network agnostic for accessing the ECS?
That all said, I note that the ability of Samsung phones to call emergency services is tested by Samsung engineers here at a laboratory accredited by the National Association of Testing Authorities, which is in addition to testing done by the telcos’ own networks engineering teams.
It turns out, however, that standard testing was reportedly unable to reliably detect the bad firmware configuration in the 71 problematic Samsung Models. Telstra only found it in October 2025 (the month in which the Testing Code was enacted) through what were said to be ‘advanced technical procedures’. Australian technology news and policy outlet, iTnews, confirmed that the problematic configuration might have gotten past four different testing bodies.
How fabulous.
These are just some of the litany of operational and regulatory issues that I have raised thus far in Hardcoded.
Clearly, operational and regulatory settings have not been good enough.
As will be detailed later in this series, they require reform.
Here’s the next piece.
