This might not be legal, and is one of the large problems that needs to be resolved. You individually are listed in this law as a "designated service provider",

This might not be legal, and is one of the large problems that needs to be resolved. You individually are listed in this law as a "designated service provider", and thus you can't really pass the buck to your employer. There is a valid question as to whether you are listed as a "designated service provider" if the only time you ever developed the relevant software under s317C(6) was as part of a job. But software developers that have done free software work outside of their job definitely would be counted. As always, I would suggest you get legal council before doing anything in response to a notice -- even throwing it back in the face of the AG.