Acceptable Use Policy

This Acceptable Use Policy sets out how you may and may not use a Service we supply to you. It forms part of your Agreement with us, and it applies to every Service in Section B — nbn broadband and mobile — for both Consumer Customers and Business Customers.

We have three aims: to keep our Services and the networks we rely on working properly for everyone, to meet the obligations our Suppliers and the law place on us, and to protect you and other people from harm.

This policy applies to:

(a) you, as the account holder; (b) anyone you allow to use your Service — including members of your household, your employees, contractors, guests or customers; and (c) anyone who uses your Service because you have not kept it secure.

You are responsible for use of your Service by all of these people, as explained in the You are responsible for use of your Service clause of Section A. If someone uses your Service in a way this policy does not allow, we treat that as your breach of this policy — so it is worth making sure the people who use your Service know these rules.

We will update this policy from time to time, including when a Supplier or a law or industry code changes what we must require of you. If a change is detrimental to you, we will give you notice as described in Section A.

You must not use your Service, or allow it to be used:

(a) to commit an offence, or to do anything that is unlawful under Australian law or the law of any place you are dealing with; (b) to send, publish, store, access or share material that is defamatory, harassing, menacing, offensive, abusive, or intended to intimidate or stalk a person; (c) to send, publish, store or share child sexual abuse material, pro-terror material, or other material that is unlawful or that we are required to act on under the Online Safety Act 2021 (Cth) or an industry code or standard made under it; (d) to make hoax or nuisance calls, or calls or messages of a kind dealt with under the Handling of Life Threatening and Unwelcome Communications industry code (C525:2023); (e) to infringe another person's copyright, trade marks, patents, confidential information, privacy or other rights; or (f) to impersonate another person, or to misrepresent your identity or your association with any person or organisation.

Where the eSafety Commissioner, a law enforcement agency, a court or another authority gives us a notice or direction about material or activity on your Service, we must comply with it. See the Security, interception and lawful assistance section of Section C for how we handle requests of that kind.

You must not use your Service, or allow it to be used, to:

(a) gain or attempt to gain unauthorised access to any network, system, account, device or data — ours, a Supplier's, or anyone else's; (b) probe, scan or test the vulnerability of a network or system, including port scanning, without the operator's permission; (c) launch or take part in a denial-of-service or distributed denial-of-service attack, an amplification or reflection attack, or any other attack on the availability of a service; (d) forge or spoof an identifier — including an IP address, MAC address, email header, calling line identification or sender ID — or otherwise disguise the origin of traffic; (e) create, host, distribute or command malware, ransomware, botnets, spyware or similar harmful code; (f) circumvent, or attempt to circumvent, any authentication, usage limit, filtering or security measure applied to your Service; or (g) interfere with, degrade or place an unreasonable load on our network, a Supplier's network, or another customer's use of a service.

We may take action under this policy to protect the security or integrity of a network, including to meet our obligations under Part 14 of the Telecommunications Act 1997 (Cth). Where the risk is immediate, we may need to act before we contact you — see If this policy is breached below.

You must not connect Equipment or a device to the network that does not meet the applicable Australian technical standards, or that causes interference. See the Equipment and customer cabling section of Section C.

You must not use your Service, or allow it to be used, to:

(a) send unsolicited commercial electronic messages of any kind, including email, SMS, MMS or instant messages, in breach of the Spam Act 2003 (Cth); (b) send bulk or mass messages to recipients who have not consented to receive them, or from whom you cannot demonstrate consent; (c) send messages that do not clearly identify the sender, or that do not include a functional unsubscribe facility where one is required; (d) operate an open mail relay, open proxy, or any other server configured so that third parties can use it to send messages; (e) harvest, scrape or buy email addresses or mobile numbers for the purpose of sending unsolicited messages; or (f) take part in phishing, spoofed sender addresses, or any messaging designed to deceive a recipient about who sent it.

If you send marketing messages using your Service, complying with the Spam Act 2003 (Cth) is your responsibility. Our own marketing practices — consent, identification and unsubscribing — are set out in our Marketing Communications Policy in this Section D.

We may apply reasonable technical measures to protect our network and other customers from messaging abuse, including rate limits on outbound messages and blocking traffic we reasonably believe to be spam or malicious. We will apply those measures only to the extent reasonably necessary, and we will tell you if a measure affects your legitimate use.

You must not use your Service, or allow it to be used, to:

(a) make or send scam calls, scam SMS, or any call or message intended to deceive a recipient into providing money, credentials or Personal Information; (b) generate artificially inflated traffic — that is, calls or messages generated wholly or partly to earn or trigger a payment, rebate, commission or other benefit, rather than for genuine communication; (c) take part in traffic pumping, revenue-share fraud, wangiri (one-ring) schemes, robocalling, or automated dialling that is not permitted by law; (d) manipulate calling line identification, sender IDs or number ranges to make traffic appear to come from somewhere it did not; or (e) resell or make available your Service, a SIM card, or a number range to a person you know or reasonably suspect will do any of these things.

We have obligations to detect, trace, block and report scam calls and scam SMS under the Reducing Scam Calls and Scam SMS industry code (C661:2022). Traffic of the kinds listed above is one of the things that code requires us to act on. Where we identify it on your Service we may block the traffic, bar the Service, or cancel it, and we may be required to report it and to share information with a Supplier, ACMA or law enforcement.

You are responsible for Charges arising from traffic of this kind on your Service, including where it results from your Equipment being compromised. Keeping your own systems secure matters here — see Your equipment and your own network below. Our broader approach to scams is described in the Scam, nuisance and unwelcome communications section of Section C.

You must not use a mobile Service:

(a) for machine-to-machine (M2M) or Internet of Things applications — for example telemetry, remote monitoring, alarm or lift lines, EFTPOS or vending terminals, digital signage, fleet or asset tracking, or embedded SIMs in equipment; or (b) as a mobile back-up, failover or redundancy connection for another internet service — for example a SIM in a router that carries traffic when a fixed connection drops out.

These are restrictions our upstream wholesale Supplier places on us for the mobile network we resell, and we are required to pass them on. They are not preferences on our part: we cannot waive them, and we cannot grant an exception.

If you need a back-up connection, we sell one. Our 4G Backup Service is built for exactly this purpose and runs on a different network, precisely because the mobile network we resell may not be used this way. Talk to us rather than repurposing a mobile plan — see the 4G Backup Service terms in Section B.

We do not currently offer an M2M or IoT product. If that is what you need, tell us anyway. We would rather have the conversation than have you put an M2M device on a mobile plan and have it barred later.

If a mobile Service is used in either of these ways, our Supplier may require us to bar or disconnect it, and we may have to do so — in some cases at short notice, because the requirement comes from above us. Where we can, we will contact you first and give you a reasonable opportunity to stop the non-permitted use before we bar or cancel the Service. Where our Supplier requires immediate action, we will tell you as soon as we can afterwards.

Beyond these two restrictions, the general principle our Supplier applies is that an individual user must not use the Service in a way that causes detriment to the greater network. Where that arises, our first step will be to contact you and work through it.

You must not resupply, resell, share for payment, or otherwise commercially exploit a Service, or allow another person to do so, unless we have agreed in writing or the Service is supplied to you as a wholesale product.

This does not stop you from letting your household, employees, contractors, guests or customers use a Service in the ordinary way — for example, providing Wi‑Fi in your café or office. It does stop you from operating your own carriage service or internet service using a Service we supply to you as a retail product.

We apply this restriction because a resupply arrangement changes the regulatory and technical obligations that attach to a Service — including consumer protection, emergency call, number and IPND obligations — and those obligations are ours to meet. If you want to supply services to your own customers, talk to us: we can tell you whether a wholesale arrangement is available and what it would require.

The terms of each of our products are the same whether the Service is used privately or commercially. You will not breach this Agreement by running a business on a plan we sold as a home plan, and we will not move you to a more expensive plan because of how you use the Service.

What differs between plans is what they include, not what you are permitted to do with them. Our Business Plans exist because businesses often need things a home plan does not provide — for example a static IP address, different support arrangements, or an enhanced service level agreement. Enterprise Fibre exists because some sites need dedicated, symmetrical capacity that a shared nbn Service cannot deliver.

If we think a different plan would suit you better, we will tell you what it offers and what it costs, and leave the decision to you.

Two things do constrain how a Service may be used, and they are set out elsewhere: the prohibition on resupplying or reselling a Service in No resupply or resale below, and the restrictions on mobile Services in Mobile Services must not be used for machine-to-machine or back-up connections below.

The Services we supply are delivered over shared, contended network infrastructure. For nbn broadband, capacity is shared at several points — in the access technology serving your premises, in the aggregation we buy from our Supplier, and in our upstream transit. For mobile, radio capacity at each cell site is shared between everyone connected to it at the time.

This means the speeds and performance you experience will vary. They depend on how many people are using the network at the same time, the access technology at your premises, the equipment and cabling in your premises, the capability of your device, your distance from a mobile cell site, and the capacity of the servers you are connecting to. For nbn Services, our typical busy-period speed information is published as required by the Telecommunications (NBN Consumer Information) Industry Standard 2018 and appears in your Critical Information Summary.

Because capacity is shared, fair use is not a technicality — it is how we keep the Service usable for everyone. The Fair use and network management section of Section C sets out the general position, and this clause explains how we apply it.

You must use your Service reasonably. Use is not reasonable if it is excessive compared with what a plan of that kind is designed for, or if it materially degrades the Service other customers receive, or the operation of our network or a Supplier's network. Examples include sustained maximum-rate traffic on a mobile Service, running high-volume commercial servers on a residential broadband Service, and automated traffic generated by scripts rather than by a person.

Where we reasonably believe your use is excessive or unreasonable, we may manage it. "Manage" means one or more of:

(a) shaping — reducing the speed of your Service for a period, so it keeps working but uses less capacity; (b) restricting a particular type of traffic, or applying a data or session limit; or (c) offering to move you to a plan better suited to how you use the Service.

Before we do any of these things, we will contact you where it is practicable to do so, explain what we are seeing, and give you a reasonable opportunity to change how you are using the Service. We will only act without contacting you first where there is an immediate risk to network integrity or to other customers' Services, or where the law or a Supplier requires us to act immediately.

Any action we take will be proportionate, will last no longer than reasonably necessary, and will be reversed once the issue is resolved. We will not use fair use management as a way to avoid delivering the Service you have paid for, and nothing in this clause limits your rights under the Australian Consumer Law.

Security is a shared responsibility. We protect our own network and systems, and we work with our Suppliers on the networks they operate. What sits inside your premises — your router, Wi‑Fi, devices, servers and cabling — is yours to look after, and most abuse we see originates from customer equipment that has been left open or unpatched.

You must take reasonable steps to keep your Service and your own network secure, including:

(a) changing default passwords on your router and any Equipment, and using strong, unique passwords; (b) keeping firmware, operating systems and security software up to date; (c) securing your Wi‑Fi with current encryption, and not operating an open or unsecured wireless network that allows others to use your Service anonymously; (d) not leaving remote administration, port forwarding or management interfaces exposed to the internet unless you have deliberately secured them; and (e) keeping your SIM cards, account credentials and account verification details secure, and telling us promptly if they are lost, stolen or compromised — see the Keeping your account and Service secure clause of Section A.

If your equipment is compromised and is used to attack others, send spam, or generate scam or artificially inflated traffic, that is a breach of this policy and we may need to act on it. We would much rather help you fix it: if we detect something on your connection that looks compromised, we will contact you and tell you what we can see. You remain responsible for Charges incurred on your Service, including through compromised equipment, subject to the exceptions in Section A.

If you need help securing your equipment, call us on 1300 994 884. Practical guidance for households and small businesses is also published by the Australian Cyber Security Centre at cyber.gov.au.

If we reasonably believe this policy has been breached on your Service, we take an escalating approach:

(a) first, we contact you — we tell you what we have seen, ask you to fix or stop it, and give you a reasonable period to do so; (b) if it is not fixed, we may restrict the Service, or the part of it involved — for example barring a call type, blocking a traffic type, or shaping the connection; (c) if it is still not fixed, we may suspend the Service; and (d) as a last resort, or where the breach is serious and cannot be remedied, we may cancel the Service.

We will give you notice and an opportunity to fix the issue wherever it is practicable to do so. We may act immediately, and tell you afterwards, only where:

(e) there is an immediate risk to the security or integrity of a network, to emergency call access, or to the safety of any person; (f) there is a real risk of significant financial loss or fraud, including from scam or artificially inflated traffic; (g) the law, a court, a regulator or an ACMA-registered industry code or standard requires us to act immediately; or (h) a Supplier requires us to bar or disconnect the Service, as described in Mobile Services must not be used for machine-to-machine or back-up connections above.

When we exercise any of these rights we will act reasonably and go no further than reasonably necessary — the full commitment is in the How we apply our rights to restrict, suspend and cancel clause of Section A, which applies to any action we take under this policy. Charges may continue to accrue while a Service is suspended, as explained in that clause, and if we cancel a Service early any applicable early termination Charge is set out in your Critical Information Summary.

We will not restrict, suspend or cancel a Service for non-payment while you are meeting the terms of an approved arrangement under our Financial Hardship Policy in this Section D. If you think we have acted wrongly, you can complain — see our Complaints Handling Policy in this Section D, and you can go to the TIO at any time.

If you believe someone is using a Lightning IP Service in a way this policy does not allow, please tell us. That includes abuse you have received from our network, and abuse you have discovered on your own connection — self-reporting a compromised device is always better than waiting for us to find it.

You can report abuse:

(a) by phone on 1300 994 884; or (b) using the contact details on our website, lightningip.com.au, which include the current address for reporting network abuse.

It helps us a great deal if you can include the date and time (with time zone), the IP address, phone number or sender ID involved, and any headers, logs or screenshots you have. We will acknowledge your report, investigate it, and take action under this policy where it is warranted. We may not be able to tell you the outcome for another customer's Service, because of our privacy obligations.

If your report is a complaint about something we have done, we will handle it under our Complaints Handling Policy in this Section D. If it concerns unlawful or threatening content, or a life-threatening situation, contact the police on 000 as well — and let us know, so we can respond to a lawful request quickly. Scams can also be reported to the National Anti-Scam Centre at scamwatch.gov.au, and online harm to the eSafety Commissioner at esafety.gov.au.