% cat legal/acceptable-use-policy.txt

Acceptable Use Policy

The IT Dept Pty Ltd · ABN 12 665 405 505 · v1.0 · 10 June 2026

The customers here are network people, so this is short. The address space on this network is clean and twenty years of reputation sits behind it. Keeping it that way is a shared interest, and the actual rule is one sentence: don't do things that are illegal, abusive, or that damage the network or its reputation. The rest is detail.

Don't

• Use the services for anything unlawful under Australian law or the law where your traffic lands.
• Send spam or bulk unsolicited messages (the Spam Act 2003 applies), or operate infrastructure for others who do.
• Originate or facilitate attacks: DDoS, unauthorised scanning or exploitation of systems you don't own or lack permission to test, credential stuffing, malware C2, phishing.
• Forge headers, spoof source addresses (BCP38 is enforced at my edge — spoofed packets don't leave this AS), or misrepresent your identity to registries or IRRs.
• Host or distribute content that's unlawful to host in Australia.
• Interfere with other customers' services, the platform, or my ability to run it.

Fine, with manners

• Security research against systems you own or are authorised to test. Tell me first if it'll look like an attack from the outside; it saves us both an abuse-desk conversation.
• Tor relays, mirrors, public services — generally welcome; exit nodes require a conversation first, not forgiveness later.
• Mail servers — yes, with correct rDNS, SPF/DKIM/DMARC, and an attitude of taking bounces seriously. Snowshoe behaviour gets you nulled.

Abuse handling

Abuse reports go to abuse@theitdept.au and are read by a human (the human). You'll be given the report and a reasonable window to respond — except where the issue is active and damaging, in which case the MSA's immediate-suspension clause applies and we talk after the bleeding stops. Repeated, unhandled abuse ends the relationship.

The spirit of the thing

If you're unsure whether something is okay, ask — the answer is fast and usually yes. This policy isn't here to police hobbies; it exists so that one bad actor can't burn the address space everyone else relies on.