[tptacek]

I don't understand what's "minor" about this crime.

If theft of meter SIM cards became endemic, the utility and the MNO would have to spend millions or even tens of millions of dollars to deploy countermeasures. That spend is entirely deadweight loss that exists solely to mitigate bad actors.

Not subverting your power meter seems like a pretty reasonable clause in the social contract that enables us all to have (extraordinarily) cheap and convenient electrical power.

[iloveponies]

It would have cost them far less if they had the foresight to consider the chances of it happening, or at least try and arrange it with Telstra, who's more than capable of doing so in a way that would mitigate abuse from the service?

[tptacek]

How? How would it have cost them less? That seems like a good question to answer preemptively if you're going to make that argument. And, while you answer it, keep a running tally in your head of roughly how much it would cost in (1) legal fees and (2) delayed deployment (which has a cost you can break out in $/hour based on continued needless truck rolls as only one example) to negotiate that with the MNO.

When you're finished, weigh that cost against the benefit of reducing the legal fees for criminals who steal service from your meters.

[metageek]

>How? How would it have cost them less?

They could have arranged with Telstra to cut off service to any meter that billed over $X in a month.

In fact, that should have been an obvious step to make, because a meter that was sending too much data was probably buggy, which could mean the data it was sending was probably worthless. The engineers who failed to include the cutoff were insufficiently paranoid.

[tptacek]

What about meter diagnostics? "Cut off" means "cut off"; what if the utility needs the capability of remote snapshotting the memory or current firmware rev of a meter? (Having done multiple smart meter security review projects: this is not a crazy notion).

Yes, fellow geek, there will be some number that represents the maximum amount of bandwidth that might ever be used to diagnose a faulty meter. How much would it cost to figure that out? Again: weigh that against the business benefit of doing so.

The person who abused the meter SIM did not accidentally do so.

[iloveponies]

Now that this has happened, and both the MNO and the power company are trying to prevent it happening again, that would suggest they are changing the service, and thus the lawyers will be called back in again to amend the service agreement accordingly. Ignoring the costs associated with both the potential extra PR costs in cleaning this up, the costs associated with IT or modification to meters either installed or otherwise, or the costs with the power company's representation during the court case I could imagine that this return visit by the lawyers wouldn't be put onto the MNO's bill entirely, nor would they be getting a discount compared to the smaller amount of time I assume it would take to define the preventative requirements as part of the agreement before it was finalised.