In Australia is it illegal for a company to sell substandard security?

Question

In Victoria (Australia), is it illegal for a company to sell substandard security?

1. Physical security (locks, access devices, keypasses, etc.)
2. Digital security (data encryption, login credentials, etc.)

Two ways it could happen:

1. At the time of sale they said it was fit for purpose but it had known published security vulnerabilities
2. There were no known published security vulnerabilities but the security system was installed incorrectly leading to potentially easy breaches

There are two scenarios I can think of:

1. The vulnerability was discovered due to a breach
2. No known security breaches; a security review discovered the vulnerability

Do any of these variations change the legality?

Answer 1

Illegal? Yes. Criminal? No.

Goods that are not fit for purpose and services that are not performed with due care and skill breach the consumer guarantees under the Australian Consumer Law (if you are a consumer). You are a consumer if the price is less than $40,000 or the product or service is normally bought for household consumption.

If they breach the guarantees, you have rights to:

• repair, replacement or refund
• cancelling a service
• compensation for damages & loss.